(Wiley Corporate F & A Series) Doxey, Christine H - Internal Controls Toolkit-Hoboken (2019)
(Wiley Corporate F & A Series) Doxey, Christine H - Internal Controls Toolkit-Hoboken (2019)
Toolkit
Founded in 1807, John Wiley & Sons is the oldest independent publishing
company in the United States. With offices in North America, Europe, Asia, and
Australia, Wiley is globally committed to developing and marketing print and
electronic products and services for our customers’ professional and personal
knowledge and understanding.
The Wiley Corporate F&A series provides information, tools, and insights
to corporate professionals responsible for issues affecting the profitability
of their company, from accounting and finance to internal controls and
performance management.
Internal Controls
Toolkit
Christine H. Doxey
Copyright © 2019 by John Wiley & Sons, Inc. All rights reserved.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used
their best efforts in preparing this book, they make no representations or warranties
with respect to the accuracy or completeness of the contents of this book and specifically
disclaim any implied warranties of merchantability or fitness for a particular purpose. No
warranty may be created or extended by sales representatives or written sales materials.
The advice and strategies contained herein may not be suitable for your situation. You
should consult with a professional where appropriate. Neither the publisher nor author
shall be liable for any loss of profit or any other commercial damages, including but not
limited to special, incidental, consequential, or other damages.
For general information on our other products and services or for technical support,
please contact our Customer Care Department within the United States at (800) 762–
2974, outside the United States at (317) 572–3993, or fax (317) 572–4002.
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some
material included with standard print versions of this book may not be included in e-books
or in print-on-demand. If this book refers to media such as a CD or DVD that is not included
in the version you purchased, you may download this material at http://booksupport
.wiley.com. For more information about Wiley products, visit www.wiley.com.
10 9 8 7 6 5 4 3 2 1
Contents
v
vi ■ Contents
2.8 Collection 75
2.9 Cash Receipts and Application 77
2.10 Price Establishment 79
2.11 Promotional Activities 81
Metrics 191
Sub-Processes 191
8.1 U.S. Government Contracts—General 191
8.2 U.S. Government Contracts—Non-Commercial Products 197
8.3 U.S. Government Contracts—Commercial Products 199
8.4 Contracts with State and Local Governments and
Educational Institutions Within the United States 202
8.5 Contracts with Governments Outside the United States 203
Glossary 341
Index 385
Introduction to the Internal
Controls Toolkit
INTRODUCTION
Companies of all sizes are subject to a variety of risks. Among them are legal,
regulatory, strategic, operational, financial, and reputational. Each functional
organization is subject to one or more of these types of risk, each of which may
impact the company’s bottom line. Companies use a number of policies and
tools, such as insurance, establishment of reserve funds, and investment pol-
icies, and standards of control to manage risk.
The concept of internal control is one of the trademarks of effective gov-
ernance and good business operations. Without a strong system of internal
control, organizations cannot ensure that the interests of company stake-
holders are being protected. Strong internal controls support organizational
goals and objectives, while helping safeguard against the risks of financial
loss, operational waste, environmental irresponsibility, corporate fraud, and
even reputational damage that can be irreparable. Internal control over
financial reporting continues to be a major area of importance in the gover-
nance of an organization.
This toolkit provides a series of standards of internal control and the risks
they mitigate for all enterprise-wide operations. The fraud risks for today’s
corporate environment are significant as indicated by the statistics provided
in the following sections. The standards will set the foundation for good con-
trol and will help to mitigate the risk of fraud. According to the 2018 Report
to the Nations prepared by the Association of Certified Fraud Examiners
(ACFE), Anti-fraud controls work. The ACFE analyzed 18 anti-fraud controls
were analyzed and every one correlated to lower fraud losses and faster fraud
detection.
1
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
2 ■ Introduction to the Internal Controls Toolkit
Source of
Organization Report Key Findings Information
Source of
Organization Report Key Findings Information
Source of
Organization Report Key Findings Information
to ensure that risk was mitigated, and to determine that remediation activities
were completed. The standards of internal control can be leveraged to enhance
an existing controls program or to validate your current SOX 404 work.
entity-level processes. The following example takes a look at the standard for
the invoice processing sub-process within accounts payable.
1.1 Managers are responsible for integrating effective internal controls into all company
operations. This responsibility includes identifying, assessing, and managing risks that
affect the accomplishment of their business objectives. The resulting internal control
activities must be monitored to verify they are effective and working as intended.
1.2 All employees must comply with the company code of conduct.
1.3 Statements of corporate policy must be adhered to by all operating units. Policies
and procedures established within operating units must, at a minimum, meet and
not be in conflict with the control requirements specified by corporate policy.
Policies and procedures must be periodically reviewed and updated.
1.4 The company’s financial statements must be prepared in conformity with accounting
principles. In addition, no false or intentionally misleading entries shall be made in
the company’s accounting records.
1.5 Adequate segregation of duties and control responsibilities must be established
and maintained in all functional areas of the company as one of the three critical
corporate controls. In general, custodial, processing/operating, and accounting
responsibilities should be separated to promote independent review and evaluation
of company operations. Where adequate segregation cannot be achieved, other
compensating controls must be established and documented.
1.6 All representations made in the annual letter of representation must be supported
and the appropriate documentation must exist and be retained in accordance
with the controller, financial representation, and controls assurance process and
statements of corporate policy.
1.7 Costs and expenses of all operating units must be maintained under budgetary
control. Comparisons of actual expenses to budgeted amounts must be performed
on a regular basis, and all significant variances explained.
1.8 All operating units must develop a system of internal controls to ensure that the
assets and records of the company are adequately protected from loss, destruction,
theft, alteration, or unauthorized access.
1.9 Critical transactions in the company’s business processes must be traceable,
authorized, authenticated, have integrity, and be retained in accordance according
to corporate policies.
8 ■ Introduction to the Internal Controls Toolkit
Introduction
1. Background
4. Procure to Pay (P2P) 14. Customer Services Protection of Assets and Employees
5. Hire to Retire (H2R) 15. Professional Services 11. Protection of Assets – Human,
Physical, and Intellectual
13. EH&S
Glossary
11
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
12 ■ Background on Internal Controls
For example, breakdowns in the internal control structure can occur due
to a simple error or mistake, as well as faulty judgments that could be made
at any level of management. In addition, controls can be circumvented by
collusion or by management override and a fraudulent payment.
Finally, the design of the internal control system is a function of the
resources available, meaning that a cost-benefit analysis must be in the
design of the system. The cost of payment controls should never exceed
the benefits of the internal system. And the value of a good internal con-
trol system should always adequately reduce and help to mitigate risk for the
corporate payment process.
1. The focus should be on the business process and any sub-processes rather
than just the audit process.
2. The control should be focused on the end-to-end process and its depen-
dencies rather than just on transactions. Although the control should
address the accuracy of a transaction, a risk-based control addresses the
total business process and not just a single transaction.
3. The expected outcome is to identify and mitigate risk as well as determine
opportunities for process improvements within the operation.
4. There should be a focus on risk management rather than solely on current
policies and procedures. Current policies and procedures may be outdated
or incorrect.
5. The goal should be on continual risk assessment coverage through a con-
tinuous controls monitoring (CCM) process.
6. Risk-based internal controls facilitate change since they should be updated
when there is a significant change to the business process or if the control
is found to inadequately mitigate a potential risk.
7. This approach should set the foundation for implementing operational
metrics and analytics.
8. Risk-based controls can identify risks and business process gaps across
financial operations.
9. Risk-based controls can help prevent and detect fraud since they should
represent the end-to-end business process.
10. Risk-based controls should always be developed by the business process
owners, but approved by management with well-defined implementation
and remediation plans.
Here are five questions to ask when developing a series of risk-based con-
trols along with the five key metrics to consider when measuring results.
■■ Loss of assets
■■ Undetected errors
■■ Compromise of proprietary data, etc.
■■ Managing identified risks down to acceptable levels
■■ Providing the company with disciplined process management
■■ Facilitating achieving business objectives effectively and efficiently
Key Point: Some of the root causes for internal control problems are
listed below.
implemented these controls as “core controls” but need to keep them updated
by following some of the best practices that are recommended below. The three
critical controls will be referenced throughout the standards of internal control
provided in this toolkit.
1
Uwadiae, Oduware, “COSO—An Approach to Internal Framework,” accessed October 1, 2018,
https://www2.deloitte.com/ng/en/pages/audit/articles/financial-reporting/coso-an-approach-
to-internal-control-framework.html.
The Goals and Challenges of Internal Controls ■ 21
The five components of the COSO model are depicted in the chart below.
The COSO model has driven many internal controls systems and Sarbanes-
Oxley efforts in the corporate environment.
Component Principle
Component Principle
bjectivity of the evaluators of internal controls will establish the roles and
o
responsibilities.
COBIT—1996
Control Objectives for Information and Related Technology (COBIT) was cre-
ated in 1996 by the Information Systems Audit and Control Association
(ISACA) and the IT Governance Institute. COBIT helps management derive
the greatest benefit from information technology through appropriate IT
governance and control. Its framework delineates processes and control objec-
tives for planning/organization, acquisition/implementation, delivery/support,
24 ■ Background on Internal Controls
SysTrust—1999
Jointly developed by the American Institute of Certified Public Accountants
(AICPA) and the Canadian Institute of Chartered Accountants (CICA),
SysTrust is a professional service designed to build confidence and garner trust
in the systems that support an entity or activity. It allows for measuring reli-
ability in regard to a system’s availability, security, integrity, and maintain-
ability. Certified Public Accountants (CPAs) use SysTrust to verify and provide
assurance that system controls are operating effectively.
Corporate Frauds—2001–2002
The late 1990s and early 2000s painted a shameful picture of corporate
America—a picture of unbridled greed and arrogance with a no-holds-barred
approach to personal gains, an absence of corporate integrity and ethics,
aggressive engagement in questionable or fraudulent business practices,
highly compromised corporate governance, and—not surprising—the demise
of public trust. Although the many corporate frauds perpetrated during this
time would fill a toolkit on their own, only two will be covered here: Enron
and WorldCom.
Prior to its bankruptcy in late 2001, Enron, the organization named
“America’s Most Innovative Company” by Fortune magazine every year from
1996 to 2001, was one of the world’s leading electricity, natural gas, pulp
and paper, and communications companies. It employed approximately
22,000 workers. In 2000, the same year Enron was on Fortune’s “100 Best
Companies to Work for in America” list, it claimed revenues of nearly $101
billion. Enron was widely recognized as an exemplary company with excel-
lent long-term pensions, fine benefits, and extremely effective management.
In August 2001, however, financial analyst Daniel Scotto became
concerned about the company’s practices and warned his investors to sell
Enron stocks and bonds. As later became widely known, many of Enron’s
recorded assets and profits were inflated, or even wholly fraudulent and
nonexistent. The company hid debts and losses by setting up inappropriate
The Goals and Challenges of Internal Controls ■ 25
“off-balance sheet” entities. Because these debts were not included in the
firm’s financial statements, Enron looked more profitable to investors than
it actually was. To continue the illusion of billions in profits, even though
the company was on the edge of collapse, those at the top of the company
perpetrated more and more financial deception, which drove Enron’s stock
to higher levels. At this point, Chief Financial Officer Andrew Fastow and
other executives who had manipulated the deals used insider information
and traded millions of dollars of the stock, leaving the company in shambles
and Enron stockholders with devastating losses.
Not unlike Enron, the story of WorldCom is one of deception and greed
of those at the top who used fraudulent practices to mask declining profits.
They classified operating expenses as capital expenditures, creating an
illusion of financial growth and profitability to drive up the company’s stock.
In 2002, when Cynthia Cooper, an internal auditor, discovered the ques-
tionable accounting practices and uncovered a $3.8 billion fraud, she blew
the whistle by reporting her findings to the WorldCom Audit Committee.
The accounting fraud perpetrated by WorldCom executives led to the largest
bankruptcy in history, and investors lost an estimated $180 billion.
■■ Evaluate and test internal controls over financial reporting using COSO to
opine on effectiveness (broad and deep).
■■ Assessment must be based on procedures sufficient to evaluate design and
test operating effectiveness. Inquiry alone will not provide adequate basis
for assessment.
■■ Significant support is required from operations and controller organiza-
tions as up to 70% of key controls can be outside of financial reporting.
wiki/Enterprise_risk_management.
Enterprise Risk Management Integrated Framework—2004 and 2013 ■ 29
meeting its objectives or accomplishing a key strategy? Lastly, can the risk
be managed?
The Committee of Sponsoring Organizations of the Treadway Commission
(COSO) issued Internal Control—Integrated Framework to help businesses and
other entities assess and enhance their internal control systems. That frame-
work has since been incorporated into policies, rules, and regulations, which
are used by thousands of enterprises to better control the process to achieve
established objectives.
ERM is a process, affected by an entity’s board of directors, management,
and other personnel, that is applied during strategy setting across an
enterprise in order to:
■■ Identify potential events that may affect the entity and manage risks to be
within its “risk appetite,” which can be defined as the risk tolerance that a
firm is willing to allow.
Some firms are very conservative and avoid risk by the focus on
too many controls. As an example, a firm may have multiple levels of
approvals for expenditure. This can become a signature-gathering pro-
cess rather than a true approval process.
■■ Provide reasonable assurance regarding the achievement of entity
objectives.
ERM is a process that provides a reasonable level of assurance that
the firm’s total objectives will be achieved.
management has a process established to set objectives and that the chosen
objectives support and align with the entity’s mission and are consistent
with its risk appetite.
3. Event Identification—Internal and external events affecting achieve-
ment of an entity’s objectives must be identified, distinguishing between
risks and opportunities. Opportunities are channeled back to manage-
ment’s strategy or objective-setting processes.
4. Risk Assessment—Risks are analyzed, considering likelihood and impact,
as a basis for determining how they should be managed.
5. Risk Response—Management selects risk responses—avoiding, accept-
ing, reducing, or sharing risk—to develop a set of actions that align risks
with the entity’s risk tolerance.
6. Control Activities—Policies and procedures are established and imple-
mented to help ensure the risk responses are carried out effectively.
7. Information and Communication—Relevant information is identified,
captured, and communicated in a form and timeframe that enables people
to carry out their responsibilities. Effective communication also occurs in a
broader sense, flowing down, across, and up the entity.
8. Monitoring—The entirety of ERM is monitored and modifications made
as necessary. Monitoring is accomplished through ongoing management
activities, separate evaluations, or both. Management activities are defined
as business planning, internal controls, communication, corporate gover-
nance, and corporate infrastructure.
An ERM Checklist
Starting at the enterprise level, control considerations include:
The table below applies the control type to standard risk objectives, and
control measures or activities:
Risk Management
Objective Control Measure Type of Control
Risk Management
Objective Control Measure Type of Control
Compensating Controls
Effective compensating controls can improve the design of a process that has
inadequate segregations of duties and ultimately provide reasonable assurance
to managers that the anticipated objective(s) of a process or a department will
be achieved.
However, compensating controls are less desirable than the segregation
of duties internal control because compensating controls generally occur
after the transaction is complete. Also, it takes more resources to investigate
and correct errors and to recover losses than it does to prevent an error.
Other Controls
Other organization and corporate defined controls are described in the follow-
ing sections. These types of controls are embedded in the governance structure
of a corporation and support the major types of controls that are integral to the
payments process.
Organization Controls
Organizational controls should cover all aspects of the company’s business
processes without overlap, and be clearly assigned and communicated.
Policy Controls
Policy controls are the general principles and guides for action that influence
decisions. They indicate the limits to choices and the parameters or rules
to be followed by the company and its employees. Major policies should be
reviewed, approved, and communicated by senior management. Policies are
derived by:
Procedure Controls
Procedure controls prescribe how actions are to be performed consistent
with policies. Procedures should be developed by those who understand the
day-to-day actions that will be subject to the procedures.
Supervisory Controls
Examples of supervisory controls are situations in which managers ensure
that all employees understand their responsibilities and authorities, and the
assurance that procedures are being followed within the operating unit.
Review Controls
Review controls include an ongoing self-assessment process as required by
the Sarbanes-Oxley Act of 2002. A controls self-assessment (CSA) process is
a series of questions that validate the effectiveness of the control environment.
As a best practice, a self-assessment must be conducted every fiscal quarter for
a specific business process or sub-process. In some situations, the manager of
the operating unit may elect to conduct a self-assessment test more frequently if
automated continuous monitoring tools are used. It is imperative that all weak-
nesses found in the testing process are remediated through a corrective action
and follow-up process.
36 ■ Background on Internal Controls
The Institute of Internal Auditors (IIA) defines CSA as a process through which
internal control effectiveness is examined with the objective of providing reason-
able assurance that all business objectives are met. The employees performing
CSA work are in the functional area being examined rather than upper-level
managers that are above the system of internal controls.
These employees have a wealth of information about internal controls
and fraud (if it exists). While internal (or independent) auditors can be
involved with CSA initiatives, auditors do not “own” the process and do not
make the assessments and evaluations.
Key Point: If there is an environment of internal control, controls are
understood and embedded at the tactical level, and the process is validated by
a CSA, cost of controls can be reduced drastically. More importantly, the risk
of fraudulent behavior is significantly mitigated. The standards of internal
control provided in this toolkit will help to determine the areas of risk and key
controls to focus on in a CSA process.
The most common approaches to performing CSA activities are facil-
itated team meetings, CSA surveys, and management’s focus on a specific
internal control or area of their business.
■■ A facilitated team meeting is the most popular form of CSA. The facili-
tated sessions consist of 6 to 15 employees who are subject on a day-to-day
basis to the internal controls being evaluated. A trained facilitator guides
the meeting, and another individual records the activity.
■■ The survey approach uses questionnaires to elicit data about con-
trols, risks, and processes. It differs from traditional internal control
questionnaires used by auditors because the operational employees
(not the auditors) use the survey results to self-evaluate the controls
or processes. At some companies a survey approach may be used to
evaluate “soft” controls. It may be used to evaluate the effectives of
an ethics program that is considered an entity-level control. (Refer to
Chapter 16.)
the controls of a specific process. Lastly, this approach can also be used in a
workshop setting.
The connection between fraud and the tone at the top of an organization has
received a great deal of attention over the last few years. “Tone at the top” refers
to the ethical atmosphere that is created in the workplace by the organization’s
Ethics and “Tone at the Top” ■ 39
■■ How we compete
■■ Bribery and facilitation payments
■■ Gifts and entertainment
■■ Conflicts of interest
■■ Use of company assets
■■ Safeguarding important information
■■ Political involvement and contributions
■■ The application of human rights standards in our business
■■ Our environmental responsibilities
■■ Timely payments of suppliers
■■ Other issues
1. Internal fraud: One or more employees facilitate the activity by using false
entries to cover the action. The activity can be concealed for a length of time
so that fraud is not easily recognized.
2. External fraud: Someone outside of the accounts payable department
is able to gain access to company assets through fraudulent means. As a
result, funds are misappropriated or extorted from the company.
3. Conspiracy fraud or collusion: This is a combination of both internal
and external fraud in which an employee conspires with someone outside
of the company such as a vendor or an ex-employee to commit a fraudu-
lent activity.
ENTITY-LEVEL CONTROLS
quite easy to determine based on the results of the tests mentioned above, but
can also be supported by reviewing the following:
Chief Executive ■■ The chief executive officer is ultimately responsible and should
Officer (CEO) assume ownership of the system.
and Executive ■■ More than any other individual, the chief executive sets the tone
Management at the top that affects integrity and ethics and other factors of a
Team of the positive control environment.
Organization ■■ Senior managers in turn assign responsibility for establishment of
more specific internal control policies and procedures to personnel
responsible for the unit’s functions.
■■ In a smaller entity, the influence of the chief executive, often an
owner-manager, is usually more direct. In any event, in a cascading
responsibility, a manager is effectively a chief executive of his or her
sphere of responsibility.
■■ In a large company, the chief executive fulfills this duty by providing
leadership and direction to senior managers and reviewing the way
they’re controlling the business.
■■ As an indication of management’s responsibility, top management
at a publicly owned organization will include, in the organization’s
annual financial report to the shareholders, a statement indicat-
ing that management has established a system of internal control
management believes is effective. The statement may also provide
specific details about the organization’s internal control system.
■■ The primary responsibility for the development and maintenance
of internal control rests with an organization’s management. With
increased significance placed on the control environment, the focus
of internal control has changed from policies and procedures to an
overriding philosophy and operating style within the organization.
■■ Emphasis on these intangible aspects highlights the importance
of top management’s involvement in the internal control system. If
internal control is not a priority for management, then it will not be
one for people within the organization, either.
46 ■ Background on Internal Controls
Controller and ■■ Controllers and CFOs are usually responsible for the development and
Chief Financial implementation of internal controls programs for their companies.
Officer (CFO) ■■ Controllers and CFOs are also responsible for the results of the
effectiveness of the organization’s internal controls programs, which
means that controls must be updated to reflect current system and
operational environments.
■■ They are required to ensure that all accounting practices impacting
financial results are properly controlled.
■■ Controllers and CFOs also drive the assertion process required by
Sarbanes-Oxley (SOX) 404. They may lead an Internal Controls Team
with Assertion Teams to facilitate this effort as described below.
■■ A controller and CFO may also enlist the efforts of a Sarbanes-Oxley
(SOX) Steering Committee to help with the governance of the
internal controls program and assertion process. This approach is
also described below.
Internal The VP of Internal Controls, along with the Internal Controls Team,
Controls Team is responsible for implementing the requirements of Sarbanes-
Oxley (SOX) 404, by which the organization’s internal controls are
(Public
documented and evaluated. This requirement includes implementing
Company
the foundational direction for the organization’s internal controls
Example)
program. Specific responsibilities of the Internal Controls Team include:
Project Management
■■ Primary liaison to impacted organizations and external service
providers and escalate project-wide issues to management and
Steering Committee for resolution.
Tactical Project Focus
■■ Interact with controls and procedures owners.
■■ Ensure delivery of all tasks assigned to the specific work stream.
■■ Report to the Internal Controls Project Manager to obtain
scope approval.
■■ Assist with issue escalation and provide milestone
progress updates.
■■ Responsible for day-to-day work effort in areas of ownership.
■■ Working for the Internal Controls Project Manager, complete assigned
workload with designees from control and procedures owners.
Disclosure Committee, Audit Committee, and SEC Reporting (10Q
and 10K)
■■ The VP of Internal Controls attends each Disclosure Committee
meeting and presents significant controls issues that impact the
organization’s key controls.
■■ The VP of Internal Controls attends each Audit Committee meeting
and provides SOX 404 project updates and presents significant
control issues.
■■ The VP of Internal Controls develops the response for the evalua-
tion of internal controls for the 10Q and 10K reports.
Roles and Responsibilities for Internal Control ■ 47
Assertion Team As part of the structure for the SOX 404 project, and to establish
the foundational structure control environment, Assertion Teams
(Public
are established to represent each accounting cycle, process, and/or
Company
Example) business area. The Assertion Team is responsible for:
■■ Providing input and signoff on the scope of the SOX 404 project
■■ Participating in workshops, and providing access to subject matter
experts (SMEs)
■■ Completing assertion packages with the Internal Controls team
■■ Approving deliverables
■■ Providing input into testing effort during planning, execution, and
results remediation stages
■■ Addressing remediation actions
■■ Accepting responsibility for ongoing maintenance of controls and
documentation
SOX 404 The SOX 404 Steering Committee has the following responsibilities:
Steering ■■ The SOX 404 Steering Committee will provide written certification
Committee to support the organization’s Section 404 assertion on internal
(Public controls on an annual basis. This effort is supported by the sub-
Company certification process at the detailed process-owner level and the
Example) deliverable acceptance in individual process areas.
■■ The SOX 404 Steering Committee will review sensitive policies
required for SOX 404 compliance, including: Segregation of Duties,
Delegation of Authority changes, and remediation and resolution of
other enterprise-wide issues.
■■ The SOX 404 Steering Committee will provide visible sponsorship
of project and commitment of skilled resources from all represent-
ed areas, and committee members play an important role in review-
ing and understanding the project scope, approach, and risks.
Internal ■■ Internal auditors’ responsibilities typically include ensuring the ade-
Auditors quacy of the system of internal control, the reliability of data, and
the efficient use of the organization’s resources. Internal auditors
identify control problems and develop solutions for improving and
strengthening internal controls.
■■ Internal auditors are concerned with the entire range of an orga-
nization’s internal controls, including operational, financial, and
compliance controls.
External ■■ Internal controls will also be evaluated by the external auditors.
Auditors External auditors assess the effectiveness of internal control within
an organization to plan the financial statement audit.
■■ In contrast to internal auditors, external auditors focus primarily
on controls that affect financial reporting. External auditors have
a responsibility to report internal control weaknesses (as well as
reportable conditions about internal control) to the audit committee
of the board of directors.
The Order to Cash
(O2C) Process
2
CHAPTER TWO
INTRODUCTION
The O2C process includes the sub-processes of acquiring and accepting customer
orders; writing sales contracts; granting customer credit; shipping or otherwise
delivering products or services; billing and recording sales and lease transactions;
maintaining and monitoring accounts receivable; instituting effective collection
procedures; recording and controlling cash receipts; establishing pricing and pro-
motional activities; and properly valuing receivable balances.
Order to cash (O2C) and AR are important business processes within
a corporation. AR is one of a series of accounting transactions dealing with
the billing of a customer for goods and services received. In most business
entities this function is typically done by generating an invoice and mailing
or electronically delivering it to the customer, who in turn must pay it within
an established timeframe called credit or payment terms. Terms of payment
are established in the customer contract.
PROCESS OVERVIEW
The diagram below suggests that the foundational elements for the O2C process
are internal controls and compliance, ERP systems, and O2C automation
solutions.
49
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
50 ■ The Order to Cash (O2C) Process
METRICS
Table of Metrics
Table of Metrics
■■ Valid Credit Limits—Ensure all credit limits assigned to customers adhere to company
polices. Identify all sales orders by customers where the total sales order + AR balance
are greater than the customer’s credit limit.
■■ Unauthorized Price Changes—Verify that prices in the price master file are autho-
rized and valid. Identify all sales orders where the individual who entered/modified
prices in the price master has the proper systems access.
■■ AR Billing Status and Review—Monitor the AR transactions, specifically billing and
adjustment type transactions, per customer, to identify clients with a high adjust-
ment ratio. This information can help uncover the manipulation of client records,
and ultimately assets such as inventory. Examine the AR transactions file (billing and
adjustments) with the objective of profiling clients who appear to have a high number
of adjustments, write-offs when compared to their charges.
■■ Days Sales Outstanding (DSO)—Ensure all billings are within a timely manner. Iden-
tify all Invoices where the corresponding sales order was entered greater than the
<<Aging Period>> number of days before the invoice.
■■ True DSO Calculation—True DSO calculates the actual number of days credit sales
are unpaid by tracking individual invoices to the month of sale.
■■ Best Possible DSO—Best Possible DSO utilizes only your current (non-delinquent)
receivables to calculate the best length of time you can achieve in turning over
receivables. It should be compared to the standard calculation above, and be close
to your terms of sale.
■■ Delinquent DSO (Average Days Delinquent) Calculation—Delinquent DSO or
Average Days Delinquent (ADD) calculates the average days invoices are past due.
This provides a snapshot to evaluate individuals, subgroups, or overall collection
performance.
■■ Countback DSO Calculation—The Countback Method of calculating takes into
account sales fluctuations. Giving more weight to the current month’s sales, it reflects
the correct assumption that most of the A/R balance will be from current, as opposed
to previous, sales. It also takes into account the real effect of the actual difference in
the number of days per month (e.g. 28 in February vs. 30 in April, June, September,
and November vs. 31 the rest of the months).
■■ Sales Weighted DSO Calculation—Sales Weighted DSO, as with the regular DSO
calculation, measures the average time that receivables are outstanding. However,
some consider it an improvement over other methods of calculating DSO because it
attempts to smooth out the bias of credit sales and terms of sale.
■■ Collection Effectiveness Index (CEI)—The Collection Effective Index, also known as
CEI, is a calculation of a company’s ability to retrieve their accounts receivable from
customers. CEI measures the amount collected during a time period to the amount
of receivables in the same time period. In comparison, the collection effectiveness
index is slightly more accurate than daily sales outstanding (DSO) because of the
time period.
2.1 Order Entry/Edit ■ 53
SUB-PROCESSES
Introduction
Customer and product master data must be accurate, timely, with the
appropriate safeguards to ensure the data is secured. Orders/contracts must
be properly documented and fully edited before they are released to production
and/or shipping, as appropriate.
2.1.12 Order Terms. Order administration should ensure orders being pro-
cessed are consistent with corporate standards (margin, risk, payment
terms, project milestones, etc.).
Refer to risk: A-7
Introduction
The U.S. government controls exports of sensitive equipment, software, and
technology as a means to promote our national security interests and foreign
policy objectives.
Through this export control system, the U.S. government can effectively:
■■ Provide for national security by limiting access to the most sensitive U.S.
technology and weapons.
■■ Promote regional stability.
■■ Take into account human rights considerations.
■■ Prevent proliferation of weapons and technologies, including of weapons
of mass destruction, to problem end-users and supporters of international
terrorism.
■■ Comply with international commitments (e.g. nonproliferation regimes
and UN Security Council sanctions and UNSC resolution 1540.
Under the current export control system, three different USG agencies have
the authority to issue export licenses: the Departments of State, Commerce, and
the Treasury. In 2009, licensing agencies within these departments processed
over 130,000 applications. In 2010 alone, the Department of Commerce
processed approximately 22,000 applications. In some cases, exporters were
required to apply for multiple licenses from separate departments.
The goal of the ECR Initiative is to create a Single Licensing Agency
(SLA), which would act as a “one-stop shop” for businesses seeking an export
license and for the USG to coordinate review of license applications. The
result will be a licensing process that is transparent, predictable, and timely.
The United States controls lists correspond directly with the lists main-
tained by the various multinational export control regimes, but are augmented
by unilateral controls when necessary to ensure national security and foreign
policy imperatives.
The three major lists of export-controlled items are the Commerce Control
List (CCL), the United States Munitions List (USML), and the Nuclear Regulatory
Commission Controls (NRCC).
2.2 Export Controls ■ 57
1
U.S. Department of State, “A Resource on Strategic Trade Management and Export Controls,”
accessed January 5, 2019, https://www.state.gov/strategictrade/overview/.
58 ■ The Order to Cash (O2C) Process
Introduction
Sales contracts may be in, but are not limited to, these forms:
2.4 CREDIT
Introduction
Formal, written credit procedures (e.g. establishment of credit terms, reserves
for bad debt, promissory notes, direct loans, indemnified transactions) should
be established and implemented for each operating unit and be consistent with
policy established by the corporate controller.
Credit limits must be established for each customer with established
payment terms. Credit limits must be recorded in an information system (e.g.
customer master) that is used for managing the shipment of orders to cus-
tomers. A review of approved credit limits and the current receivable balance
must be made before additional customer orders are accepted and/or shipped.
The review should consider all regional and business units’ leasing or direct
sales resulting in the global receivable balance.
pay and should be balanced between the local and global credit posi-
tion. Reliable outside sources of information must be used to establish
such limits.
Refer to risks: D-2, D-4
Credit Limit Exceptions. Credit management approval is required
2.4.3
before credit is extended in excess of approved limits. When extended
credit is granted, a timeline should be established with criteria for an
extension/reduction process when period expires or criteria are not met.
Refer to risks: D-2, D-4
2.4.4 Credit Limit Reviews. Established customer credit limits must be
documented, filed, and reviewed for adequacy at least annually. Where
appropriate, adjustments to credit limits must be made in accordance
with approved corporate policies/procedures. Customer credit history
must be maintained.
Refer to risks: D-2, D-4
Past Due Customers. Customers must be assigned “refer to credit”
2.4.5
designation whenever undisputed past due balances exist on their
accounts. All orders placed by these customers must be approved by
Credit prior to being released for shipment.
Refer to risks: D-2, D-4
2.4.6 Terms of Sale. Standard terms of sale must be extended to all cus-
tomers or classes of customers. Exceptions to standard terms of sale
must only be made in concert with custom product delivery and custom
services delivery and approved by appropriate level of management.
Refer to risks: D-2, D-4
Segregation of Duties. Credit administration must be independent of
2.4.7
the order entry, billing, general ledger, and sales functions.
Refer to risks: D-2, D-3
2.4.8 System Access. Individuals with system capability to make entries
in the accounts receivable subsidiary ledger (e.g. cash application,
account write-offs, sales concessions, and sales discounts) must not
have system capability to invoice customers, issue credit memos, or
adjust the general ledger. If this separation is not possible due to limited
staff size, compensating controls must be documented, implemented,
and followed.
Refer to risk: D-2, D-3, D-5
64 ■ The Order to Cash (O2C) Process
2.4.9 Cash Rebates. Where rebates are not processed as credits, a process is
established to ensure the account is current. Cash rebates should be ini-
tiated by credit, authorized by finance, paid by accounts payable, and
reconciled by finance.
Refer to risk: D-3, D-6
2.4.10 C
ash Deductions. Customer deductions (debit memos) are created
by credit, approved by region finance, and applied by appropriate
finance function.
Refer to risk: D-3
2.4.11 D
isputes and Concessions. Guidelines must be developed and moni-
tored for dispute detection, tracing, and resolution. Criteria and approval
for concession must be developed and monitored.
Refer to risks: D-4, D-6
2.5 SHIPPING
Introduction
Numerically controlled shipping transactions must be prepared for all goods
shipped. Evidence of shipment must be transmitted to accounting or billing
module in a timely manner, generally within 24 hours. Sales cut-off require-
ments for revenue recognition purposes will be followed by the shipping
department.
2.5 Shipping ■ 65
2.5.9 Sales Cutoff. There will be no deviations from the company’s sales
cutoff policy.
Refer to risk: E-7
2.5.10 B
lank Shipping Forms. Blank shipping authorizations, numerically
controlled shipping documents, and bills of lading must be safeguarded
from unauthorized access and use.
Refer to risks: E-8, E-10
2.5.11 S
egregation of Duties. The shipping function must be independent of
the physical inventory count, order entry, billing, accounts receivable,
and general ledger functions.
Refer to risks: E-3, E-10
2.5.12 C
omplaints. Customer correspondence (billing and shipping com-
plaints, service problems, etc.) must be investigated and resolved in
a timely manner.
Refer to risks: E-4, E-8, E-10, E-11
2.5.13 D
rop Shipments. Locations involved with domestic and international
drop shipments must have documented procedures that are enforced.
Refer to risks: E-1, E-2, E-3, E-7
E-9 Backorders or lost sales orders may not be identified and resolved on
a timely basis.
E-10 Intentional errors or misappropriation of assets could occur.
E-11 Customer dissatisfaction may result.
Introduction
According to International Finance Reporting Standards (IFRS) criteria, for
revenue to be recognized, the following conditions must be satisfied:
1. Risks and rewards have been transferred from the seller to the buyer.
2. The seller does not have control over the goods sold.
3. The collection of payment from goods or services is reasonably assured.
4. The amount of revenue can be reasonably measured.
5. Costs of revenue can be reasonably measured.
An explanation for each condition is provided below.
■■ Conditions (1) and (2) are referred to as Performance. Regarding
performance, it occurs when the seller has done what is to be expected to be
entitled to payment.
■■ Condition (3) is referred to as Collectibility. The seller must have a reason-
able expectation that he or she will be paid for the performance.
■■ Conditions (4) and (5) are referred to as Measurability. Due to the accounting
guideline of the matching principle, the seller must be able to match the rev-
enues to the expenses. Hence, both revenues and expenses should be able to
be reasonably measured.
IFRS 15, revenue from contracts with customers, establishes the specific
steps for revenue recognition. It is important to note that there are exclusions
from IFRS 15 such as:
2
Corporate Finance Institute (CFI), “Revenue Recognition,” accessed January 1, 2019, https://
corporatefinanceinstitute.com/resources/knowledge/accounting/revenue-recognition/.
68 ■ The Order to Cash (O2C) Process
2.6.15 Accurate Invoices. Invoices must accurately reflect the items shipped
or services provided. Invoices, both manual and computer generated,
should be reviewed for accuracy on a test basis.
Refer to risks: F-3, F-4, F-6, F-9, F-12
2.6.16 Taxes. Sales, use, and/or value-added taxes must be billed in accordance
with local laws. Where tax is not billed, supporting documentation is
required to support the customer’s tax-exempt status. This documenta-
tion must be obtained and filed.
Refer to risk: F-10
2.6.17 “Zero-Dollar” Invoices. All invoices or other billing documents con-
taining “zero-dollar” or “no charge” items must have written approval
by local Finance and Marketing management (according to their
respective authorization levels).
Refer to risk: F-11
2.6.18 Partial Shipments. Where partial shipments are not accepted by
a customer, billing should be in agreement with the customer’s PO.
Refer to risk: F-6
2.6.19 Invoice Delivery. Invoices must be sent directly to the customer upon
product shipment or service completion and must not be returned to
the Credit department for revision.
Refer to risk: F-13
2.6.20 Approved Exceptions. All billing exceptions, such as no charge
invoices/line items, billing price overrides, credits and adjustments,
and change orders must be properly approved and within the individu-
al’s level of authority.
Refer to risks: F-12, F-16
2.6.21 Credits and Adjustments. Credits and adjustments associated with
returns, short shipments, promotional programs, or discounts of prod-
uct must only be processed when the claim has been investigated,
proper documentation has been prepared, and authorization has been
obtained from appropriate Sales and Marketing, Finance, Operating
Unit, and Supply Chain Management depending on the nature of the
adjustment. All discrepancies (e.g. unmatched documents) must be
resolved in a timely manner.
Refer to risks: F-5, F-14, F-15
2.6 Revenue Recognition/Billing ■ 71
F-7 Billing errors may cause cash flow not to be maximized, and certain
accounts may become uncollectible.
F-8 Cash flow may not be maximized due to untimely billings, and the
amount may be uncollectible.
F-9 Export requirements may be violated. The company may be exposed to
litigation from external sources for misrepresentation of invoices.
F-10 The company will be liable for unbilled sales tax or value-added tax where
adequate documentation verifying tax-exempt status is not on file.
F-11 “No charge” transactions may not be properly recorded in the accounting
records. Related-party transactions may not be identified.
F-12 The company may be assisting the customer in circumventing the cus-
tomer’s internal control system.
F-13 Intentional alteration of the invoice and/or receivable records
could occur.
F-14 Credit transactions may not reflect the proper accounting treatment or
may conflict with good business practices.
F-15 All credit transactions may not be included in the accounting records.
F-16 Unauthorized use of the documents may occur, resulting in a loss of rev-
enues or an adverse effect on the company’s reputation.
Introduction
AR represents an integral portion of a company’s income-generating process
and requires special attention in ensuring monies owed it are accurately moni-
tored, collected, and reported. Controllers and AR professionals need to be able
to apply their skills and understanding to companies of all sizes—small owner/
operator companies, mid-level companies, and Fortune 500 firms.
A mid-level company may have an electronic or computer-based
invoicing system that will allow the company to know when invoices were
issued so as to age amounts due. However, the company may not utilize such
a system but rely on defined processes and a paper trail. Such a company
could employ as few as one person who is responsible for AR, or as many as
four or five.
2.7 Accounts Receivable (AR) ■ 73
a. Sales are invoiced but not recorded. Upon receipt, cash is misap-
propriated.
b. Cash receipts are incorrectly applied to customer accounts and/or
are misappropriated or diverted.
G-2 The subsidiary ledger may be inaccurate as invoices and/or cash receipts
may not be recorded, may be incorrectly recorded, or may be recorded in
the wrong accounting period.
G-3 Inefficient collection activities may occur, and/or incorrect aging
may result in delinquent customer remittances or the write-off of
delinquent accounts.
G-4 Errors in either the general or subsidiary ledgers may not be identified
and corrected on a timely basis.
G-5 The accounts receivable valuation reserves may be incorrectly calculated.
Net receivables and the related financial statements may be misstated.
G-6 The financial records and financial statements may be misstated.
G-7 Adjustments processed may not reflect good business practices, or
adjustment errors may not be detected.
G-8 Collectible accounts receivable may be written off, and/or cash receipts
may be misappropriated.
G-9 Loss, destruction, or alteration of accounts receivable records may result
in the inability to collect outstanding balances.
G-10 Unauthorized use of customer receivable information could adversely
affect the company’s competitive position or reputation.
G-11 Receivables may not be collected from terminated employees.
G-12 Errors and omissions, poor receivable management practices, and inap-
propriate concentration of risk may not be detected and corrected on
a timely basis.
2.8 COLLECTION
Introduction
Formal, written collection procedures must be developed and implemented by
each operating unit that controls accounts receivable balances.
76 ■ The Order to Cash (O2C) Process
Introduction
All remittances must be applied to the specific customer account level within
a specified time (e.g. 72 hours). Credit cards, checks, electronic funds transfer,
and electronic data interchange receipts must be considered to be cash, and
the same standards associated with cash receipts must be followed. Cash
receipts must be logged and deposited in the bank daily or as dictated by good
business practice.
Introduction
A documented pricing policy as well as specific pricing actions must be approved
by global business unit and local business unit management and reviewed with
finance for administrative feasibility. Pricing strategies must be consistent in
determining global market prices and pre-established minimum margin targets
for all products.
Introduction
Pricing and promotional activities may include, but are not limited to, the
following:
a. Volume rebates
b. Coupons
c. Premium items
d. Product giveaways
e. Allowances
f. Cooperative advertising
g. Cash rebates
h. Meet-competition/tactical payments
i. Third-party (end-user) rebates
j. Special performance incentive funds
k. Off-invoice discounts
82 ■ The Order to Cash (O2C) Process
INTRODUCTION
85
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
86 ■ Treasury Process
Treasury Processes
Business Treasury Funding and Exposure Risk Management Capital and Liquidity
Raise Short and Long Term Asset and Liability Management Rating Agency
Deal Structuring Debt
Currency Hedging
Regulatory Relationships
Liquidity
Commodity Price Risk
PROCESS OVERVIEW
The diagram below suggests that the foundational elements for the Treasury pro
cess are Internal Controls and Compliance, Treasury Policies and Procedures,
and Code of Conduct, and “Tone at the Top.”
METRICS
Table of Metrics
■■ Accuracy of Cash Forecasts—Actual cash balance minus forecasted cash balance)/
forecasted cash balance.
■■ Accuracy of Forecasted Investment Income—Actual interest investment income
minus forecasted investment income)/forecasted investment income.
■■ Accuracy of Forecasted Interest Expense—Actual interest expense minus fore-
casted interest expense/forecasted interest expense.
■■ Accuracy of Trustee/Issuing, Paying Agent Fees—Actual fees minus forecasted
fees)/forecasted fees.
■■ Percentage of Payments Containing Errors—(1) Number of payments by type con-
taining errors/total number of payments by type. (2) Number of payments containing
errors/number of payments.
■■ Percentage of Payments Released on Time—Total number of payments released on
time/total number of released payments.
■■ Percentage of Daily Cash Balances vs. Forecast—Sum of daily cash balances/fore-
casted total cash balances.
■■ Days Cash Available—Total available cash/average value of payments per day.
■■ Percentage of Committed Credit—Total principal value of committed credit facil-
ities/total principal value of all credit facilities.
■■ Credit Available—Total principal value of drawn credit/total principal value of all
credit facilities.
■■ Portfolio Credit Rating—Weighted average of issuer credit ratings vs. stated policy
benchmark.
controls implementation is that the cost of a control should not exceed the
benefit derived. However, there is minimum set of controls that should exist in
a normal business environment. The internal control standards listed here rep
resent the minimum controls to be implemented within the Treasury process.
SUB-PROCESSES
Introduction
Policies are implemented for all aspects of the Treasury function to ensure that
segregation of duties, controls, and reconciliation processes are in place to miti
gate risk for the company. Financing, financial investment, foreign exchange,
capital stock, and equity transactions must be promptly recorded and properly
classified to facilitate the reporting and required disclosure of external financial
information. All recorded balances must be reconciled monthly to the support
ing detail (e.g. bank account reconciliations, revolving credit lines, investment
sub-ledgers, capital stock, ownership records, etc.).
Introduction
The following items and activities must be approved by the board of directors of
the company and must be documented in minutes of their meetings: banking
resolutions and the assigned delegation of authority, borrowing resolutions
and delegations of authority, all significant debt financing arrangements and
financing leases.
Introduction
Financial investment policies and procedures must exist and be approved
in advance by the company treasurer or designee and must specify, at a
minimum: type, credit quality, and maturity of instruments, approved coun
terparties, counterparty exposure guidelines, and personnel authorized.
3.3 Investment of Available Funds ■ 93
C-5 Financial statements and records may be misstated due to improper cut
offs or valuations, omission of certain financial data, or inaccurate record
ing or classification.
C-6 Reports may not be accurate, and critical decisions may then be based
upon erroneous information.
C-7 Transactions may result in undesirable legal and/or tax implications.
Introduction
The corporate treasurer is solely responsible for managing the company’s foreign
currency risk. Foreign currency “spot” transactions as defined as the purchase
and/or sale of foreign currency to satisfy payment obligations due in the next
one to three business days are not “hedging” but require the establishment of
operating procedures and controls that must be approved by the corporate trea
surer or designee.
INTRODUCTION
The P2P process includes the functions of securing and qualifying sources of
supply; initiating requests for materials, equipment, merchandise, supplies, or
services; obtaining information as to availability and pricing from approved
suppliers; placing orders for goods or services; receiving and inspecting or
otherwise accepting the material or merchandise; accounting for the proper
amounts due to suppliers; and processing payments in a controlled and efficient
manner. In this toolkit, research and product development is included in the
P2P process.
How does a P2P leader anticipate, plan for, and mitigate a potential risk? In this
chapter we’ll address how 10 P2P Automation Solutions can be used to help
mitigate risk. We’ll only identify the specific risks that are mitigated by imple-
menting the solution.
97
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
98 ■ Procure to Pay (P2P) Process
Risks Mitigated
■■ E-invoicing eliminates the risk of processing a duplicate invoice, paying
an incorrect amount, or paying the invoice to an incorrect supplier.
■■ It removes possible financial exposure for the company since invoices
are paid more accurately.
■■ It also reduces the risk of fraud and builds in Segregation of Duties
(SoD) controls.
4. PO to Invoice Conversion—This technology allows a buying organiza-
tion to send a purchase order electronically to a supplier and then allows
the selling organization to convert the purchase order into an electronic
invoice. The seller can then submit the invoice immediately back to the
accounts payable organization. The resulting invoice will be a duplicate of
the original purchase order.
Risks Mitigated
■■ Eliminates the risk of processing a duplicate invoice, paying an incor-
rect amount, or paying the invoice to an incorrect supplier.
■■ This automation solution also reduces the risk of fraud and builds in
Segregation of Duties (SoD) controls.
■■ Speeds up the approval time and can improve working capital manage
ment since there are now more opportunities for early payment discount.
■■ The approval status of an invoice can be shared with a supplier as
part of this automation solution. This alleviates the need for supplier
inquires and can improve supplier satisfaction.
5. Document Management, Invoice Scan, and Data Capture—A docu-
ment management system is used to track and store electronic documents
and/or images of paper documents. It is usually also capable of keeping
track of the different versions modified by different users. The term has
some overlap with the concepts of content management systems. It is often
viewed as a component of enterprise content management (ECM) systems.
Risks Mitigated
■■ Eliminates the risk of processing a duplicate invoice, paying an incor-
rect amount, or paying the invoice to an incorrect supplier.
■■ This automation solution also reduces the risk of fraud and builds in
Segregation of Duties (SoD) controls.
6. Automated Matching—Automated three-way matching provides
an immediate match of the invoice, purchase order, and receipt when
using related accounts payable automation solution. The user estab-
lishes specific business rules for the matching process and reviews
100 ■ Procure to Pay (P2P) Process
resulting audit trails to ensure the process is working. The user is also
responsible for resolving any exceptions that may occur to determine
if violation of business rules needs to be addressed.
Risks Mitigated
■■ Automated matching performs the three-way with no human inter-
vention, reducing the risk of error and improper matches.
■■ Reduces the risk of paying an erroneous or duplicate payment.
■■ Improves the invoice cycle time process and reduces processing costs.
■■ Provides data accuracy based on user-defined matching rules.
7. Automated Workflow Approvals—In an automated workflow
approval process, the invoice approval process is linked to your compa-
ny’s Delegation of Authority (DoA) policy. The invoice approval process is
completely automated based on defined rules via workflow. The workflow
determines if an invoice needs approval; who the appropriate approvers
are; and in what order approvers should approve payment of the invoice.
The workflow then sequentially asks each approver in the approval list to
approve invoices online. For example, you can define a rule so invoices
over $100,000 (or a specific amount designated in your DoA policy)
require CFO approval and then CEO approval.
Risks Mitigated
■■ An automated workflow can be linked to the employee master file in
which approval levels are automatically updated when an approval
moves to another department and is promoted.
■■ Reduces the risk of fraud since there is no opportunity for manual
manipulation.
■■ Escalation processes can be built into the workflow to link to the
Delegation of Authority (DoA) policy and tables.
8. E-Payment—If your company is paying more than 50% of invoices
by check, it’s way too many. I suggest paying your invoices by ACH or
P-Card. Consider the cost of issuing the check, postage fees, resource fees,
reconciliation costs, and the risk of check fraud. The e-payment process
also includes the use of ACH supplier remittances rather than issue a sep-
arate manual remittance for an invoice payment. Additionally, if your
accounts payable department is faced with ongoing escheatment issues
due to uncashed suppler checks, besides looking into ACH and P-Cards
for your payment process, consider outsourcing your payments process.
Risks Mitigated
■■ The E-payment process reduces risk and enhances internal control for
the P2P process.
Consider Automation to Mitigate Risk in the P2P Process ■ 101
Supplier Reporting
Contract Purchasing Supplier
Selection Invoice P-Card Payment Accounting Analytics, and
Management and Ordering Receiving Master T&E Process Customers
and Processing Process Process Processes Metrics
Process
Management
The need
Obtain W-9 Receipt T&E Accruals
for Goods &
Goods and or W-8 (ERS) P-Card Payment and the Produce
Services Is Processing Suppliers
Terms & Services Are Processing Approval Fiscal Close Spend
Identified Requistions
Conditions Received Reports and
Perform TIN elnvoice
Matching or or Manual Payment General Analytics
VAT Validation Invoice Processing Ledger
RFI P-Card ACH, Check Procurement
Administration P-Card, and • SLAs
Supplier
3-Way and Controls T&E Audit • Strategic
Validation and Wire Clearing Track
Sourcing
Compliance Match and Control
Screening Accounts Results
Purchase Receipt Is Process and Trends
Contract Auto Shared
Orders Processed Reporting,
RFP Perform
Reporting, Payments Service • DPO & Other
Periodic Supplier PO Flip Analytics • Recurring Cash AP Metrics
Validation and Metrics and Center
and Metrics Payment Management
Screening Analytics Customers
PROCESS OVERVIEW
The diagram below suggests that the foundational elements for the P2P pro-
cess are Internal Controls and Compliance, ERP Systems, and P2P Automation
Solutions.
METRICS
Table of Metrics
Functional Metrics
■■ Total Cost of the Total P2P Function as a Percentage of Revenue
■■ Total Cost of the Procurement Function as a Percentage of Revenue
■■ Total Cost of the Accounts Payable Function as a Percentage of Revenue
■■ Number of FTEs in the Total P2P Function
■■ Number of FTEs in the Procurement Functions
■■ Number of FTEs in the Accounts Payable Function
Procurement Cost and Process Metrics
■■ Cost per RFP
■■ Cost per Contract
■■ Cost per Purchase Order
■■ Strategic Sourcing Cost Savings
■■ Purchase Order Workflow Defects
■■ Unapproved Items in Purchase Order Workflow
■■ Non-Purchase Order Invoices
■■ Cost per P-Card Transaction
104 ■ Procure to Pay (P2P) Process
Table of Metrics
Table of Metrics
SUB-PROCESSES
Introduction
Purchases must be made from an approved supplier database/list in accor-
dance with local procedures. A formal process should be in place to approve
purchases from suppliers not on the approved database or on a government
watch-list such as the Office of Foreign Assets (OFAC) and the Office of Inspector
General (OIG). Suppliers need to be screened to ensure that foreign officials and
politically exposed persons (PEPs) are not included on the supplier master file
and the Foreign Corrupt Practices Act (FCPA) is not violated. Noncompliance
with any of these screening processes noted could result in significant fines and
damage to the company’s reputation.
A-3 Goods purchased may not meet quality standards. Unauthorized prices or
terms may be accepted.
A-5 Records may be misused or altered by unauthorized personnel to the detri-
ment of the company and its suppliers.
A-6 Materials may be received early or late, resulting in business interruption
or excess levels of inventory.
A-7 Lose opportunity to revise supplier base to better meet the needs of
the company.
4.2 PURCHASING/ORDERING
Introduction
To reduce company and supplier risk for the purchasing and ordering process,
all ordering responsibilities must be segregated from accounts payable/payment,
receiving, and accounting activities. Responsibilities should be clearly defined
and system access is validated on a regular basis.
may financially obligate the company must not be done prior to the
completion of the selection process without proper approvals.
Refer to risks: B-1, B-2, B-5, B-6, B-7, B-9, B-10
4.2.6 Advance Payments. Payment in advance should be avoided if possi-
ble. A procedure should be established and followed when it is necessary
to make payments in advance of the shipment or receipt of material to
prevent overpayment. No advance payments can be made unless they
are part of the purchase order terms.
Refer to risks: B-6, B-9, B-11
4.2.7 Order Audit Trail. All orders/transactions must be uniquely identifi-
able and traceable and periodically accounted for.
Refer to risks: B-3, B-4, B-5, B-6, B-9, B-10, B-11, B-12
4.2.8 Invoice Forwarding. Purchase orders/transactions must instruct
suppliers to forward their billings directly to accounts payable.
Refer to risks: B-3, B-4, B-5, B-6, B-9, B-10, B-11
4.2.9 Purchase Order Distribution. Purchase order information must be
made available to the receiving and accounts payable departments.
Accounts payable and receiving must be notified of changed or can-
celed purchase orders immediately.
Refer to risks: B-3, B-5, B-6, B-7, B-8, B-9, B-11, B-12, B-14
4.2.10 Product Return Procedures. Procedures must be established to
ensure proper approval, recording, and follow-up of all return items
(due to poor quality, improper specifications, etc.).
Refer to risks: B-4, B-5, B-7, B-9, B-10, B-11, B-12
4.2.11 Evaluation of Purchasing Process. Purchasing process should be
evaluated consistent with the supply management.
Refer to risks: B-7, B-8
4.2.12 Safeguarding Intellectual Property. Procedures governing the
review and approval of contracts should address the safeguarding of
the company’s intellectual property, including patents and trademarks.
Refer to risks: B-4, B-5, B-10, B-12, B-13
4.2.13 Blanket Purchase Orders. A “not to exceed” limit and duration
must be specified on each blanket purchase order.
Refer to risk: B-8
4.2.14 Independence Within the Purchasing Process. Independence
between purchasing agent/buyer and supplier must be maintained.
110 ■ Procure to Pay (P2P) Process
Introduction
Both the customs border patrol (CBP) and the importing/exporting community
have a shared responsibility to maximize compliance with laws and regula-
tions. In carrying out this task, CBP encourages importers/exporters to become
familiar with applicable laws and regulations.1
Generally, the customs authority of each country is part of the treasury/
revenue department or ministry and has the primary responsibility of ensuring
not only that duties and taxes are collected on imports but also that imports
meet all their domestic laws and regulations. Such laws and regulations per-
tain to the health and welfare of its citizens and trade policies. Therefore, the
primary role of a customs authority is border enforcement rather than trade
1
U.S. Customs and Border Patrol, “Basic Importing and Exporting,” accessed January 5, 2019,
https://www.cbp.gov/trade/basic-import-export.
112 ■ Procure to Pay (P2P) Process
4.3.6 Duty Management. Duty refund and deferral programs (e.g. duty draw-
back, foreign trade zone management, and other special-duty programs)
must be administered in accordance with applicable regulations.
Refer to risks: C-1, C-2, C-6
4.3.7 Records Management. All importing entities must establish and
maintain adequate records retention systems to ensure compliance with
the company statement of corporate policy on records management.
Refer to risks: C-1, C-2, C-3, C-6
4.4 RECEIVING
Introduction
To ensure proper segregation of duties, the receiving department should be
physically segregated from the production facilities and shipping. As a key
component of the procure to pay (P2P) process, receiving is responsible for the
recording of all company receipts. The accurate receipt of good and s ervices
drives the three-way matching process in which the purchase order (PO),
invoice, and receiving document are validated for the correct pricing, quan-
tities, and price.
114 ■ Procure to Pay (P2P) Process
D-3 Rather than being returned or refused, the following items may be re-
ceived and ultimately paid for:
a. Unordered goods or services
b. Excessive quantities or incorrect items
c. Canceled or duplicated orders
D-4 Records may be lost or destroyed.
D-5 Records may be misused or altered by unauthorized personnel to the det-
riment of the company and its suppliers.
D-6 Goods and services may be received but not reported or reported inac-
curately. Unrecorded liabilities and misstated inventory and cost of sales
may occur.
D-7 Goods purchased may not meet quality standards. Unauthorized prices or
terms may be accepted.
D-8 Purchases and/or payments may be recorded at the incorrect amount, to
the wrong account, or in the wrong period.
Introduction
The AP process or function is immensely important since it involves nearly all
of a company’s payments outside of payroll. Regardless of the company’s size,
the mission of AP is to pay only the company’s bills and invoices that are legit-
imate and accurate. This means that before a supplier’s invoice is entered into
the accounting records and scheduled for payment, the invoice must reflect:
Introduction
Once company expenditures are approved for payment, the actual payment
process commences, which leads to the exchange of funds between the pur-
chasing company and its supplier. Personnel involved in the payment process
must adhere to policies and procedures designed to ensure accurate, timely,
and secure payments initiation using the appropriate payment method for
each payment.
120 ■ Procure to Pay (P2P) Process
4.6.15 ACH Payments and Wire Transfers. Payments by ACH and wire
transfer must be made only to pre-established and validated bank
accounts. Where practical, recurring wire payments should be
established as repetitive payments within the wire transfer system.
Non-repetitive wires require independent review and approval.
Refer to risks: F-1, F-4, F-6, F-7, F-8
4.6.16 Petty Cash. Payments made from petty cash must be supported by
a receipt and approved by authorized personnel in accordance with
their approval limits. In general, the use of petty cash should be avoid-
ed and a procurement card (P-Card) or other corporate credit cards
should be used.
Refer to risks: F-4, F-6, F-7
4.6.17 Custody and Security of Check-Signing Equipment. Where
check-signing equipment and facsimile signature plates or digitized sig-
nature images are utilized, the equipment and plates must be secured,
and custody of the check-signing equipment and the signature plates
or digitized signature image files must be segregated. In addition,
a reconciliation (contents are known and status is current) should be
made of checks written and checks authorized to the check-signing
machine totals.
Refer to risks: F-1, F-5
F-7 Items may be recorded and payment made for goods or services not
received.
F-8 Operations may be adversely affected as suppliers may refuse future
business with the company.
F-9 Cash utilization may not be optimized or may be misappropriated.
F-10 Fines or penalties may be imposed if required supporting documents are
not available.
Introduction
T&E expenses are “incurred when an employee conducts business away from
home or the company’s offices. For example, if one must travel to another loca-
tion to conduct a meeting with an important client, any lodging, meals, or
transportation costs usually count as travel expenses. One may deduct travel
expenses from one’s taxable income, provided they are in fact directly related
to business. For this reason, travel expenses are somewhat controversial; some
companies, for example, toolkit a business meeting at a major resort and deduct
the entire cost. Whether this is an actual travel expense is a matter for debate.”2
■■ Divide up your policy into sections: air travel, hotel lodging, dining, enter-
tainment expenses, and car rental.
■■ Provide a section that clearly states what is not reimbursable.
■■ Let employees know what enforcement measures will be taken to ensure
policy compliance.
■■ Include a guideline around traveling with spouses or significant others.
What if an employee chooses to stay over extra days? Or over a weekend?
■■ Who is responsible for travel charges if the employee cancels a reservation
or is a “no-show”?
■■ What is your policy about home offices? Can employees be reimbursed
for Internet and/or phone charges? What about office supplies or office
furniture?
2
Farlex Financial Dictionary, © 2011 Farlex, Inc. All Rights Reserved.
124 ■ Procure to Pay (P2P) Process
4.7.1 Corporate Credit Card. Employees must obtain and use a credit card
in accordance with the appropriate corporate policy.
Refer to risk: G-4
4.7.2 Reimbursable Expenses. Reimbursed expenditures must be actual,
necessary, reasonable, and consistent with the appropriate corpo-
rate policy. Any expenditures that appear to be excessive should be
investigated.
Refer to risk: G-2
4.7.3 Timely Completion of Expense Reports. Expense reports should
be completed, approved, and forwarded to the proper accounting
department in a timely fashion in accordance with corporate policy. Any
balance due the employee should be settled at that time.
Refer to risks: G-1, G-2
4.7.4 Supporting Documentation. Original receipts as required by policy
should be attached to business expense reports for all expenses over $25
or the dollar amount specified by the company’s travel policy.
Refer to risks: G-1, G-2, G-3, G-5
4.7.5 Approved Expenditures. Employee expenditures should be approved
by the employee’s supervisor. In the absence of the supervisor, expendi-
tures should be forwarded to an equal or next higher level of supervision
for approval. The authorizing signature must be authentic (e.g.
administrative assistants cannot sign in lieu of supervisors).
Refer to risks: G-1, G-2, G-3
4.8 Research and Product Development ■ 125
Introduction
Concurrent and integrated market research and product development should
be performed to analyze the need and help define customer requirements
and expectations. Organization and assignments of the research and product
development teams should include functional and cross-functional teaming to
ensure that the company process is consistent.
Introduction
According to the Professional Association for the Commercial Card and Payment
Industry (NAPCP), P-Cards provide a means for streamlining the procure-to-
pay process, allowing organizations to procure goods and services in a timely
manner, reduce transaction costs, track expenses, take advantage of supplier
discounts, reduce or redirect staff in the purchasing and/or AP departments,
reduce or eliminate petty cash, and more. Originally, P-Cards were targeted for
such low-value transactions as supplies and maintenance, repair and opera-
tions (MRO), where their use eliminated purchase orders and invoicing. Over
the years, their use has expanded to higher-value transactions as the industry
has grown and greater controls have been introduced.
128 ■ Procure to Pay (P2P) Process
INTRODUCTION
133
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
134 ■ Hire to Retire (H2R) Process
Human
Employee Payroll Payroll Reporting,
Resource
Compensation Information Payment Analytics, and
Planning and Master File Processing
and Data Metrics
Recruiting
Process Payroll per Run ACH, Advice
Develop Human Develop New Hire Payroll Cycle (Weekly, and Check
Resource Compensation Set Up Payroll Bi-weekly, Monthly) Payments to Produce Reports
Strategies to Plans Tables from Employees
Gather and Input and Analytics
Meet Business Changes in Employee Data Employee Payroll Data
Objectives Ensure Employee Status (Exempt and
Run Tax and
Non-Exempt)
Competitive Garnishment
Salaries Calculate Gross Payments
Changes in and Net Pay
Employee Data Set-up Tax
Recruit, Source, Information and per Employee
Track Results
and Select Reward Withholding
Hire, Retire, or Confirm Payroll Distribute to the and Trends
Employees and Retain Information
Employees Termination Results General Ledger
PROCESS OVERVIEW
The diagram below suggests that the foundational elements for the H2R pro-
cess are Internal Controls and Compliance, ERP Systems, and HR and Payroll
Automation Solutions.
METRICS
Table of Metrics
■■ Number and Value of Payroll Payment Issues and Errors Identified and Mitigated
■■ Number of New Hires
■■ Number of Hiring Violations Identified
■■ Number of Transfers—The number of employee transfers within the company.
■■ Number of Terminations—The number of employee terminations.
■■ Attrition Rate—Reflects the number of employees departing from a company.
■■ Employee Satisfaction Rating—Determines the level of employee satisfaction.
■■ Percentage of Performance Reviews Completed—Reports the percentage of
employee performance reviews completed.
■■ Number of Hiring and Discriminatory Issues Reported—Discriminatory issues
reported by new employees.
■■ Number and Value of Employee Benefit Issues Identified and Mitigated—Benefit
problems reported and resolved.
■■ Number of Controls Self-Assessment Performed—Number of self-assessments
performed per period.
■■ Number and Value of Compliance Fines Incurred—Number and value of
fines reported.
■■ Number and Value of Payroll Exceptions Identified—Number and value of payroll
exceptions.
■■ Number of Special Payments Paid per Period—Number of special pay-
roll payments.
■■ Cost to Process Payroll Results—The cost to process payroll.
■■ Cycle Time for Each Payroll Process—The cycle time to complete the pay-
roll process.
■■ Number and Value of Pre-Close and Post Close Adjustments for the Payroll
Process—Number and value of closing adjustments.
■■ Value of Variances Reported in Payroll Bank Accounts—Value of payroll payment
account variances.
136 ■ Hire to Retire (H2R) Process
Table of Metrics
1
William R. Tracey, The Human Resources Glossary: The Complete Desk Reference for HR Executives,
Managers, and Practitioners, CRC Press, April 19, 2016.
Sub-Processes
■ 137
The HIPAA Security Rule (HSR) establishes national standards to protect indi-
viduals’ electronic personal health information that is created, received, used,
or maintained by a covered entity. The Security Rule requires appropriate
administrative, physical, and technical safeguards to ensure the confidentiality,
integrity, and security of electronic protected health information.2 All employee
records need to be protected under this requirement.
The National Institute of Standards and Technology (NIST) HIPAA
Security Toolkit Application is a self-assessment survey intended to help
organizations better understand the requirements of the HIPAA Security
Rule (HSR), implement those requirements, and assess those implementa-
tions in their operational environment.
SUB-PROCESSES
2
U.S. Department of Health & Human Services, HIPAA Health Information Privacy, “The Security
Rule,” accessed January 13, 2019, https://www.hhs.gov/hipaa/for- professionals/security/
index.html.
138 ■ Hire to Retire (H2R) Process
Introduction
The payroll process includes the processes involved in preparing payroll checks
in a controlled and accurate manner which ensures the accurate accounting for
payroll costs, deductions, employee benefits, and other adjustments; distributing
checks to employees; and ensuring the confidentiality and physical security of
payroll and personnel information.
A payroll master file (database) must be maintained which includes
all employees of the company. Procedures must be established to physi-
cally secure and protect master file information and ensure that the HIPAA
security rule is not violated. Employees must, where required by local laws,
submit, on a timely basis, approved time reporting and attendance records
before payroll processing is performed. Payroll results must be prepared from
the payroll master file and the approved time reporting records.
Introduction
There are several important components of the payroll process. The processing
of an employee’s earned pay from gross to net amount must be done in a strict yet
varying regulatory environment. The environment varies because the process is
controlled by several entities on both the federal and state levels. A controller
and business process owner must be aware of the regulations which must be
followed to ensure compliance that will prevent audit exceptions potentially
resulting in penalties, fines, and interest.
Some of the process such as determining gross pay is regulated by either
the Federal Department of Labor (DoL) or the state’s equivalent, depending
on which one favors the employee, while others such as when an employee
142 ■ Hire to Retire (H2R) Process
must be paid are governed strictly on the state level. Still other processes such
as determining taxable gross wages are controlled by the Internal Revenue
Service (IRS). The employer is responsible for determining the correct regu-
lation to follow for each process and the controller is responsible for ensuring
the appropriate payroll controls are in place.
Payroll includes the processes involved in preparing payroll payments in
a controlled and accurate manner, which ensures accurate accounting for
payroll costs, deductions, employee benefits, and other adjustments; distrib-
uting checks, initiating direct deposits, or issuing prepaid cards to employees;
and ensuring the confidentiality and physical security of payroll and per-
sonnel information.
Introduction
This section provides the standards required for the distribution of payroll,
unclaimed wages, and non-wage payments.
Introduction
Human resources (HR) management must establish and maintain policies
and guidelines for the hiring, promotion, compensation, transfer, reloca-
tion, and termination of employees. Designated HR management must be
responsible for the administration of the employee benefit plans. The plans
must be administered in accordance with corporate policy and defined plan
procedures.
D-10 Compensation and benefits are less than that offered by comparable
companies.
D-11 Employees may not feel their efforts are noticed or appreciated.
D-12 Employee turnover rate is higher than optimal.
Introduction
Before employees are hired, HR and staffing groups along with the potential
employee’s departmental supervisor must ensure that the specific criteria are
established.
Introduction
HR management must establish and maintain policies and guidelines for
developing employees to ensure job satisfaction, risk is mitigated, and value is
provided to the company.
Introduction
HR must establish and maintain policies and guidelines for the hiring and tenure
of temporary and contract workers, such as agency temporaries and contrac-
tors, consultants, individual contractors, and third-party service providers.
150 ■ Hire to Retire (H2R) Process
INTRODUCTION
The supply chain process includes the processes for planning, manufacturing,
and warehousing product in anticipation of shipping it to a customer. This sec-
tion covers functions traditionally performed by business units, manufacturing
plants and distribution units (e.g. finished goods warehouses and international
marketing houses). The process begins with the establishment of a sales and oper-
ations plan, includes the proper recording and understanding of manufacturing
costs, and concludes with the management of finished goods inventory. Refer to
the process flow included below.
The supply chain process can be complicated due to a combination of
factors such as:
153
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
154 ■ The Supply Chain Process
Supply Chain Management Inventory Control, Product Cost, Partnerships, and Customers
PROCESS OVERVIEW
The diagram below suggests that the foundational elements for the supply chain
process are Internal Controls and Compliance, ERP Systems, and Supply Chain
and Inventory Control Automation Solutions.
METRICS
Table of Metrics
Table of Metrics
SUB-PROCESSES
Introduction
Effective planning and control enables all operating units within the supply
chain to manage operational complexities and achieve the objective of deliv-
ering the right product at the right time and the right cost.
Introduction
Effective inventory controls within the supply chain are necessary to ensure
(i) inventory levels are appropriate, (ii) inventory is safeguarded from theft and
damage, and (iii) inventory is properly valued. The inventory control function
must establish a formal plan to control all aspects of the inventory.
The receipt and transfer of inventory into, within, and out of a company
facility must be made only upon the receipt of and in compliance with a prop-
erly authorized transaction (paper or electronic), which is used to update the
inventory records in a timely manner.
Introduction
Verification of inventories, whether accomplished through complete physical
inventory verification procedures, process counting, or statistical sampling,
is necessary to ensure accurate reporting of inventories for financial as well
as operational purposes. Units are allowed to use cycle counting in place of
annual physical inventories if they have documented and implemented process
counting policies and procedures which meet the minimum corporate require-
ments. The following procedures must be adopted in performing, valuing, and
reconciling the inventory counts with inventory records.
Introduction
Inventory must be valued using the company’s valuation process consistently,
for example, lower of cost (i.e. full acquisition cost plus any import, transporta-
tion, etc., or manufactured cost) or market (i.e. net realizable value). Inventory
reserves (e.g. shrinkage, excess, obsolete, write-down to net realizable value,
etc.) must be established by operating and financial management in accor-
dance with corporate policy.
164 ■ The Supply Chain Process
Introduction
The cost accounting function provides the basis for determining product costs,
cost of goods sold, and inventory values in financial statements and other
management reports. When functioning properly, it aids management in
making decisions and developing plans and strategies for manufacturing and
service delivery.
All ledger accounts, which are used in the manufacturing unit’s cost
accounting function, must be identified, and the basis for making entries into
and between ledger accounts, including system feeds and manual transac-
tions, should be clearly described.
6.5 Product Cost Management ■ 165
Introduction
All appropriate personnel must review OEM/Alliance Partner contracts to
ensure there are no unfavorable terms and conditions, all aspects affecting
processes are understood, and payment terms do not include items outside
the contract.
Introduction
All transportation and logistics supplier facilities and operations must be in
compliance with the company’s freight or logistics supplier’s minimum secu-
rity requirements. All company raw materials and finished products need to be
packaged and palletized so as to deter theft. Product packaging should be sturdy
and not identify the part/product in any way.
G-4 Suppliers’ security performance may decrease and theft may increase.
G-5 The company is unable to contractually hold supplier accountable for
security performance and the expected level of service level agreement
(SLA) metrics.
Introduction
Policies and procedures exist to provide guidance on business practices, pro-
mote corporate consistency, and clarify roles, responsibility, and accountability
within transportation and logistics. The company has contracts established
with transportation carriers and those contracts are current, complete, and
contain adequate protection clauses if corporate fleet resources are not in
place or used.
INTRODUCTION
The R2R process encompasses the finance and transactional functions involved
in ensuring that IFRS requirements are followed by the company; preparing
journal entries and posting to the general ledger; gathering and consolidating
the information required for the preparation of financial statements and other
external financial reports; and preparing and reviewing the financial state-
ments and other external reports.
Many factors place the spotlight on the fiscal closing process, which is
usually led by a team of individuals in the corporate finance and accounting
department and managed by the corporate controller. The complexity of the
process is driven by the nature of the company (private, public, nonprofit
[tax-exempt or mission-based], or government) and the type of industry or
industries for which the company is responsible.
A recent survey conducted by the Institute of Finance & Management
(IOFM) with approximately 100 controllers revealed the resources that the
finance and accounting team typically uses to execute this critical process
is less than strategic; primarily, they tend to focus on enhancing technology
and process gaps that include the following:
173
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
174 ■ Record to Report (R2R)
Transaction
Corporate Close and Analysis and
Accumulation and Sub-Ledger Close
Consolidation Reporting
Reconciliation
■■ A lack of visibility to the status and execution of the closing process, and
the related tasks and evidence-gathering performed by finance, with the
knowledge of these processes in the heads of just a few employees
■■ Limited reporting capabilities that result in spreadsheet-based reports full
of critical financial data, which are the company’s “corporate records”
■■ Spreadsheets used to support multiple manipulations of the same data
over and over to meet various reporting requirements
■■ A lack of focus on the process basics, such as closing process checklists,
reporting templates, standard operating procedures, and business conti-
nuity plans
■■ An absence of staffing and training plans, creating a resource gap during
each closing cycle
PROCESS OVERVIEW
The diagram below suggests that the foundational elements for the R2R pro-
cess are Internal Controls and Compliance, Financial Transactions and General
Ledger, and Code of Conduct and “Tone at the Top.”
METRICS
Table of Metrics
Table of Metrics
While this is not a comprehensive list of differences that exist, these examples
provide a flavor of impacts on the financial statements and therefore on the
conduct of businesses:
1
The American Institute of CPAs (AICPA), “Is IFRS That Different from U.S. GAAP?,” accessed
January 17, 2019, https://www.ifrs.com/overview/General/differences.html.
7.1 International Transfer Pricing ■ 177
SUB-PROCESSES
Introduction
International transfer pricing relates to the cross-border transfer of goods, ser-
vices, or technology between legal entities of the company. It is the company’s
policy to establish transfer prices, which fairly apportion profits earned from
the sale of its products and services to the subsidiaries involved in generating
those profits.
The company follows the arm’s-length principle as defined by the
Organization for Economic Cooperation and Development (OECD) Transfer
Pricing Guidelines for Multinational Enterprises and Tax Administration.
The OECD provides a forum in which governments can work together
to share experiences and seek solutions to common problems and works
178 ■ Record to Report (R2R)
Introduction
The scope of this section includes all intercompany and interdivisional trans-
actions involving products and/or services. Intercompany transactions are
defined as those between two company legal entities. Interdivisional trans-
actions are defined as those within the same legal entity and between two
company divisions.
2
The Organization for Economic Co-operation and Development (OECD), “About the OECD,”
accessed January 16, 2019, http://www.oecd.org/about/.
7.2 Intercompany Transactions ■ 179
Introduction
To support the R2R process, accounting policies and procedures must be devel-
oped and documented in accordance with IFRS requirements. New accounting
policies or changes to existing policies should be properly researched, reviewed,
documented, and communicated on a timely basis. The corporate controller
must authorize all changes in accounting policies. Local finance management
may also develop applicable policies and procedures for the accumulation of
financial information to ensure compliance.
C-2 Reports may not be accurate, and critical decisions may be based upon
erroneous information.
C-3 Cash or securities may be stolen, lost, destroyed, or temporarily diverted.
C-4 SEC, IFRS, and other governmental reporting requirements and/or loan
restrictions may be violated. Exposure to shareholder litigation increases
substantially due to improper reporting.
C-5 Journal entries may be incorrectly prepared, duplicated, omitted, or made
for the purposes of misstating account balances to conceal irregularities or
shortages.
C-6 Accountability over recorded transactions may not be maintained.
C-7 Amounts could be accrued for expenses that are not likely to occur in or-
der to generate “funding” sources for future periods.
Introduction
As part of the “final mile of the R2R process, “financial information and general
ledger balances must be formally reconciled (contents are known and status is
current) to the subsidiary ledgers or other supporting records on a timely basis.
Contents and aging of the subsidiary ledger are provided in the reconciliation
process along with a concise definition of the account. Additionally, significant
fluctuations in general ledger account balances are explained as part of the rec-
onciliation process. Any differences must be promptly resolved and recorded,
generally by the next monthly reporting interval. The aging of all differences is
provided with action plans for resolution and/or the date of resolution if already
corrected.
Introduction
For the purposes of this toolkit, fixed assets include land, buildings, capital pro-
jects, machinery and equipment, furniture, fixtures, tools, and similar assets
used in the business, as well as all categories of leased equipment (rented assets,
capital leases, direct financing leases, and operating leases). Revenue is derived
from the use of these assets, rather than from their sales. Generally, an item must
have an estimated useful life of at least two years to be classified as a fixed asset.
Fixed assets are generally high-value assets that companies make use of
over the course of several to many years. For this reason, it may seem as
though fixed asset management is less critical than tracking moveable assets.
There’s little or no risk of loss, theft, and unauthorized transfer with fixed
assets, but tracking these assets is an important business function.3
3
Camcode Durable Barcode Solutions, “What Are Fixed Assets?,” posted by Nicole Pontius in Asset
Management Resources, updated June 28, 2018, accessed January 1, 2019, https://www.camcode.
com/asset-tags/what-are-fixed-assets/.
7.5 Fixed Assets ■ 187
7.5.12 Segregation of Duties. All fixed asset functions must have the follow-
ing segregation of duties controls in place:
a. Initiating, evaluating, and approving fixed asset expenditures from
property records and general ledger functions
b. Property record and general ledger functions from fixed asset custody
c. Fixed asset accounting, procurement, and custodial functions from
performing physical inventories
Refer to risks: E-1, E-3, E-10
7.5.13 Capitalization. Fixed assets must be capitalized on a timely basis in
accordance with tax regulations and GAAP.
Refer to risks: E-1, E-2, E-3
INTRODUCTION
PROCESS OVERVIEW
The diagram below suggests that the foundational elements for the government
contract process are Internal Controls and Compliance, Government Contract
Controls, and Code of Conduct and “Tone at the Top.”
189
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
190 ■ Government Contracts
Government Contracts
Ensure that new contracts are compliant with Establish Pricing Establish Cost Accounting Standards
state and federal regulatory requirements
Ensure that those responsible for contracts Monies collected from contract users are
Adhere to Delivery Requirements accurately identified, segregated, accounted
adhere to the company’s “Tone at the Top” for and paid over to the government in
and business conduct requirements accordance with the contract.
Classify the Sale Create the Customer Invoice Follow Revenue Recognition Rules
METRICS
Table of Metrics
SUB-PROCESSES
Introduction
If a subsidiary does business with a government entity either as a prime con-
tractor or subcontractor, the subsidiary, in its entirety, must comply with
certain government statutory and regulatory requirements. However, subsid-
iaries, as distinct legal entities, are not required to comply with contractually
imposed government statutory and regulatory requirements by virtue of the
company, the parent corporation, being a government contractor. Likewise,
the parent corporation is not necessarily bound by specific terms and conditions
of government contracts of the subsidiaries.
192 ■ Government Contracts
Introduction
This section applies to all company operating units and to those subsidiaries
which, directly or indirectly, provide non-commercial products or services
to the U.S. government. Non-commercial products or services are developed
based on specifications and are not generally items sold to other customers in
the normal course of business. They are sold based on either fixed price or cost
reimbursement contracts. These types of contracts should not be entered into
without the specific approval of the chief financial officer.
B-2 Civil and criminal fines and penalties against the company and/or
individual employees may occur.
B-3 Contract prices may be reduced and/or costs disallowed due to noncom-
pliance, defective pricing, and/or inadequate supporting documentation
for reported costs.
B-4 Financial statements and records may be misstated. Critical decisions may
be based upon erroneous information.
B-5 Debarment or suspension from receiving U.S. government contracts
may occur.
B-6 If review procedures are inadequate, appropriate corrective actions may
not be initiated in a timely manner.
B-7 Costs incurred in excess of funding limitations may not be reimbursed if
improper or untimely notice is given to the U.S. government.
B-8 Public embarrassment and damage to the company’s reputation could
result from failure, alleged or actual, to comply fully with all contract terms.
B-9 Extensive legal and other costs may be incurred.
Introduction
This section applies to all company operating units (business units, manufac-
turing divisions, and service and support organizations) and to those subsidi-
aries which, directly or indirectly, provide commercial products or services to
the U.S. government. Commercial products are considered “off-the-shelf” items
which are sold to other customers in the normal course of business. The prices
of such products generally are negotiated and agreed to be based on certified
commercial transaction data.
interest to the U.S. government (i.e. most favored customers and basis of
contract award customers).
Refer to risks: C-1, C-2, C-3, C-5, C-6, C-7, C-8, C-9, C-10, C-11
8.3.2 Records Management. If commercial transaction data is submitted
to the U.S. government during contract negotiation or performance,
the operating unit’s or subsidiary’s records management system shall
ensure that data concerning all commercial transactions during the rel-
evant time period(s) are preserved for a period of three years, according
to the federal regulations.
Refer to risks: C-1, C-2, C-3, C-5, C-6, C-7, C-8, C-9, C-10, C-11
8.3.3 Invoicing. Operating units and subsidiaries must establish adequate
controls over invoice compliance in order to adhere to the established
pricing policy and contract requirements.
Refer to risks: C-1, C-2, C-3, C-5, C-6, C-7, C-8, C-9, C-10, C-11
8.3.4 Pricing Policy Changes. The compliance plan developed and imple-
mented by the operating unit or subsidiary should include a process that
will ensure the government receives proper notification of changes in
the pricing policy.
Refer to risks: C-1, C-2, C-3, C-5, C-8, C-10, C-11
8.3.5 Exemptions. Operating units and subsidiaries claiming exemptions
from submission of certified cost or pricing data must have controls
in place to ensure they meet the FAR requirements for the exemption
claimed and must maintain adequate documentation to support the
basis for seeking the exemption.
Refer to risks: C-1, C-2, C-3, C-4, C-5, C-8, C-10, C-11
8.3.6 Sales Classification. Operating units and subsidiaries selling commercial
products to the U.S. government must maintain adequate data processing
systems to provide accurate and complete information concerning all
commercial and U.S. government sales. These systems must be capable of:
a. Distinguishing between federal government, state government, local
government, and commercial sales and transactions and identifying
sales under GSA (General Services Administration) contracts
b. Properly classifying and identifying each aspect of any sale or trans-
action (e.g. rebates, credits, trade-ins, free goods)
c. Properly and accurately reporting sales volume by product, cus-
tomer, category, etc.
Refer to risks: C-1, C-2, C-3, C-4, C-5, C-6, C-7, C-9, C-10, C-11
8.3 U.S. Government Contracts—Commercial Products ■ 201
Introduction
The company and its subsidiaries are suppliers to both state and local govern-
ments. Doing business with these entities poses unique requirements, remedies,
and penalties not encountered in normal commercial business.
Introduction
The company and its subsidiaries contract with non-U.S. government entities,
including quasi-governmental customers (i.e. government owned industry or
multi-government sponsored agencies), all over the world.
INTRODUCTION
PROCESS OVERVIEW
The diagram below suggests that the foundational elements that support
the records and information management process are Internal Controls and
Compliance, Records Management and Classification Standards, and Code of
Conduct and “Tone at the Top.”
207
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
208 ■ Records and Information Management
Records Management
METRICS
Table of Metrics
The GDPR was approved and adopted by the European Union (EU) Parliament
in April 2016. The regulation took effect after a two-year transition period and,
unlike a directive, did not require any legislation to be passed by government.
GDPR came into force on May 25, 2018. The GDPR not only applies to organi-
zations located within the EU but also applies to organizations located outside
of the EU if they offer goods or services to, or monitor the behavior of, EU data
subjects. It applies to all companies processing and holding the personal data of
data subjects residing in the EU, regardless of the company’s location.
The GDPR applies to personal data, meaning any information relating
to an identifiable person who can be directly or indirectly identified
in particular by reference to an identifier. This definition provides for a
wide range of personal identifiers to constitute personal data, including
name, identification number, location data, or online identifier, reflecting
changes in technology and the way organizations collect information
about people.1
1
European Union (EU) General Data Protection Regulation (GDPR), “GDPR FAQs,” accessed
January 4, 2019, https://eugdpr.org/the-regulation/gdpr-faqs/.
9.1 Standards of Internal Control Responsibilities ■ 211
SUB-PROCESSES
2
U.S. Department of Health & Human Services, HIPAA Health Information Privacy, “Summary
of the HIPAA Security Rule,” accessed January 13, 2019, https://www.hhs.gov/hipaa/for-
professionals/security/laws-regulations/index.html.
212 ■ Records and Information Management
Introduction
This section recommends the internal record-keeping requirements and
classifications that a company should consider for the data and records man
agement process.
The examples are intended to aid in the selection of a classification category that most
closely approximates the information protection needs. The examples are not intended
to be all-inclusive or definitive. Choice of the appropriate classification is always based on
how the records disclose the information and impact the company. This evaluation may
suggest a different category than that illustrated below.
9.2 Standards of Internal Record-Keeping Requirements ■ 217
INTRODUCTION
219
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
220 ■ Computer, Telecommunications, and Systems Controls
Disaster
System Access Network and Systems Recovery and Electronic Data Protection from
Controls Systems Development Contingency Processing External Threats
Planning
The implementation of
Assign Responsibilities Define Network and electronic transaction System access and
System Access Rules Establish System Define Recovery process must be activity
Define Controls and Development Standards Priorties approved and tested logs are verified
Requirement for Systems Access
before implemented
Establish Training and Report Security Risks
Communication Programs for Network and Systems
Authorized access is
Access Standards of control
Define Change Document Plan prevented by firewalls and
Issue User IDs apply to the applicable
Management Controls other system
transaction
Track User Acknowledgement protection methodologies
Define Data Controls
Statements
Verify System Access Third party providers
and SoD Controls Protect Second Party adhere to company Information shared about
Define Back-up Test Plans the company in the public
Information standards and
Define Input and Processes domain is approved
Output Controls control
PROCESS OVERVIEW
The diagram below suggests that the foundational elements of the processes
that support computer, telecommunications, and systems controls are Internal
Controls and Compliance, Controls, and Code of Conduct and “Tone at the Top.”
METRICS
Table of Metrics
Systems Metrics
■■ Number of Systems with Known Vulnerabilities—Systems that are vulnerable to
threats and attacks.
■■ Number of SSL Certificates Configured Incorrectly—SSL Certificates provide
secure, encrypted communications between a website and an Internet browser. SSL
Certificates are typically installed on pages that require end-users to submit sensitive
information over the Internet like credit card details or passwords.
■■ Volume of Data Transferred Using the Corporate Network—Usage of the corpo-
rate network.
■■ Number of Users with “Super-User” Access Level—Number of users with possible
excessive access which could put the company at risk.
■■ Number of Days to Deactivate Former Employee Credentials—The time to deacti-
vate a former employee’s system access.
■■ Number of Communication Ports Open During a Period of Time—The number of
communication ports open should correlate to the number of users.
■■ Frequency of Review of Third-Party Accesses—Determines how many third parties
(non-employees) are accessing company systems.
222 ■ Computer, Telecommunications, and Systems Controls
Table of Metrics
Table of Metrics
SAE 18
■■ Payroll Processing
■■ Loan Servicing
■■ Data Center/Co-Location/Network Monitoring Services
■■ Software as a Service (SaaS)
■■ Medical Claims Processor
224 ■ Computer, Telecommunications, and Systems Controls
SUB-PROCESSES
The specific sub-processes included in the computer systems controls process are:
Introduction
Three distinct responsibilities—owner, user, and service provider—have been
defined to assure that basic information protection policies are implemented.
Although these roles may be separate, they are sometimes performed by the
same individual.
Definitions
Owner—The company is the sole owner of information resources as well
as other company assets. The term owner is a convention used to identify
an individual who has approved management responsibility for acquiring
and controlling the use and disposition of an information resource. Each
information systems resource must have a defined owner. If more than
one individual can be considered the owner of an informational resource,
then one individual must be designated as the primary contact.
10.1 Owners, Users, and Service Providers ■ 225
A-10 The company may be liable for misuse or unauthorized copying of pro-
prietary software.
A-11 The responsibilities associated with operating and/or maintaining sys-
tem software operations and application documentation may not be
clearly defined.
A-12 Business, manufacturing, or engineering systems may become dysfunc-
tional, resulting in productivity and revenue losses, or critical data could
be destroyed.
A-14 Operational efficiency and reliability may be impaired and significantly
disrupt processing.
A-15 Volume commitments established in contracts may not be reached.
A-16 The company may not receive the discounts appropriate for its total level
of information technology purchases.
A-17 Duplicate infrastructures may be developed, increasing overall company
costs.
A-18 Company information may be disclosed, lost, or contaminated, which
may adversely affect the company’s competitive position.
A-19 Passwords to user computer or network accounts may be disclosed and
allow unauthorized access to data and programs.
A-20 Individual accountability may be lost.
A-21 Local statutory responsibilities may not be met, exposing the company to
legal liabilities.
Introduction
Management may designate certain computing and telecommunications areas
as requiring restricted access. Access to restricted computing and telecommu-
nications areas must be limited to authorized individuals on a need-to-know
basis. Examples of restricted areas are product design departments, computer
centers, telecommunications access areas and switch rooms, and network file
server locations.
230 ■ Computer, Telecommunications, and Systems Controls
Introduction
Computer access control applies to all information resources: desktops, servers,
mainframes, networks, and so on. The objective of computer access control is
to assure the integrity, availability, and confidentiality of company information
and the facilities that process, store, or transmit such information.
System access controls reduce the risk of information being disclosed,
contaminated, misused, or destroyed, whether by accidental or intentional
means. It is based upon proper authorization and establishes a basis for
internal control by enabling separation of responsibility both within and
among owner, user, and service provider functions (see Section 10.1 for detail
on roles/responsibilities of owner, user, and service provider). Restricting an
individual’s access to resources based upon “need to know” and establish-
ing individual accountability are essential principles in achieving effective
access and internal control. Refer to the definitions below to obtain addi-
tional details on computer access control.
10.3 Computer Access Control ■ 233
Definitions
Access Control—One of the most important internal controls an organi-
zation of any size should establish is access control—the doorway to all IT
systems and corporate resources. Access controls specify how the business
will monitor its IT resources and how they should be used. The most com-
monly used access controls include user accounts, consisting of passwords
and usernames; login and resource access rights; and the establishment of
privileged system accounts.
Login and Access Requests—The username and password allow
employees access to a company’s network resources. As a result, com-
panies must hold employees accountable for all activity associated with
their user accounts. For example, employees should not share their pass-
words with anyone, write them down on paper, or store them in their
computers or personal devices. If they reveal their password to IT support
staff, systems must be reset to prompt the employee for a password change
when the user logs into the system again.
Furthermore, the user account should be set up to allow employees
three login attempts only. After the third failed login attempt, the
system should disable the account. To reestablish the user account, the
employee must contact the company’s network administrator or cus-
tomer service department. Finally, access requests to network resources
should come from the employee’s direct supervisor, and the company’s
IT policies and procedures should indicate who needs to implement all
access requests.
Remote Access—Remote access extends the network’s boundaries by
enabling employees to use company resources when working outside
the office. Remote access should occur through a remote server that
allows the creation of user profiles. At least two types of profiles must be
created: a normal user profile and a user profile for each system admin-
istrator. A normal user profile has no rights to perform system opera-
tions and is given to any non-IT employee who asks for remote access
or works from a remote location. On the other hand, user profiles for
system administrators must enable them to run system applications and
tools remotely.
All remote access requests must come from the employee’s supervisor
and should specify the kind of access needed and the location where access
will take place. In addition, remote access connections should use encryp-
tion, as well as a time limit for connections that are inactive for 30 minutes
234 ■ Computer, Telecommunications, and Systems Controls
Introduction
The objectives of network operations and security controls include protection
from unauthorized network use, protection against alteration and unautho-
rized use of information while in transit through the network, and maintenance
of the integrity and reliability of network equipment and services. The scope of
this section includes voice, data, video services, and network components.
Definitions
Backbone—A main cable or network segment used to connect smaller
network subsets together into a larger logical network.
External Access—Access to company’s networks from outside company
premises. This includes accessing a company LAN or a PC on the corpo-
rate network from outside company premises.
Personal Identification—A unique, non-shared personal identifier that
uses one or more of the following:
a. Network access user ID/password combination.
b. Devices carried by the users that are part of an automatic password
changing system and identify the current network password. Such
devices are commonly known as “smart cards.”
c. Biometrics identifier such as thumbprint, voiceprint, retinal scans, etc.
Terminal or Computer Identification—A unique device ID (for either
the computer or the terminal) that is electronically supplied on request to
the host computer or access point that is being accessed. The ID is gener-
ated by special hardware in the device itself.
Terminal or Computer Location—A location that is known to be an
authorized location (e.g. via a leased circuit with known endpoints in
authorized locations).
WAN—Wide Area Network. A network segment that covers a larger area
than a Local Area Network (LAN). Usually implies use of common car-
rier services.
10.4.2 Approved Protocols and Services. Only tested and approved pro-
tocols and services will be allowed over company backbone networks.
Refer to risks: D-1, D-2, D-3
10.4.3 Network Management. Network service providers must utilize con-
figuration, performance, fault, accounting, and security management
tools to monitor and manage networks.
Refer to risks: D-1, D-2, D-3, D-4, D-6, D-7
10.4.4 Standardized Network Addresses. Network addresses must be
obtained and maintained as specified in the company network stan-
dards. If no standards exist, they need to be developed.
Refer to risks: D-2, D-3, D-7
10.4.5 Information Encryption. Users must ensure that any information
is encrypted including e-mail, fax, voice, video, and data classified
as Company Confidential when it is transmitted over the network.
In other words, any information classified as Company Confidential
must not be transmitted unless it is encrypted. Passwords must be en-
crypted during network transmission.
Refer to risks: D-l, D-4, D-5
10.4.6 Defined Owners. Each network component or service must have a
defined owner.
Refer to risk: D-8
10.4.7 Network Connection Authorization. Every network connection
must be authorized by the company unit requesting the connection
and the owner of the network segment to which the connection is
requested. Every network connection must be documented by the
owner/service provider. Every network connection must adhere to
Company Corporate and IT security standards and practices.
Refer to risks: D-1, D-4, D-5, D-9
10.4.8 Accountability for Access. Access to or actions through a network
that would compromise the security of other units on the network are
not to be permitted by any company unit. Company units that autho-
rize a non-company person or unit to access the company’s network
are accountable for their actions.
Refer to risks: D-1, D-4, D-5
10.4.9 Approved Firewalls/Routers. Any network-to-network connec-
tions between the company and non-company networks will be
through approved firewalls/routers.
Refer to risks: D-1, D-4, D-5, D-9
244 ■ Computer, Telecommunications, and Systems Controls
Introduction
All departments responsible for software development and maintenance must
define and document standard methodologies that must be used in developing
and maintaining application systems. These controls should be considered
when selecting a third party application for a business solution to ensure that a
defined development methodology is used.
E-14 Improperly trained users may not be able to adequately operate and con-
trol the system.
E-15 Company information may be disclosed, misused, or lost, which may
adversely affect the company’s competitive position.
Introduction
Change management allows organizations to plan, schedule, implement, and
track modifications to corporate activities. A formal change management pro-
cess helps IT departments ensure that the implementation of system changes are
aligned with business needs. Because of this, companies should document formal
processes to implement changes in their IT systems. Specific areas to document
include laboratory and staging areas, communication regarding changes, appli-
cation development, and internal service-level agreements (SLAs).
Changes to any production environment, including software, cloud
computing, hardware, and operating procedures, must be authorized, docu-
mented, and tested. These standards of control for the change management
process should also be considered when working with a third party on the
implementation of software for a business solution.
Definitions
Change Management—The reporting, tracking, and resolution of
change requests and problem reports for all configuration items/units.
Promotion/Migration Management—The control of logical and
physical movement of code between testing, quality assurance, and
production.
Release Management—The notification and distribution of software.
Software—Includes all levels of software—application software, operating
system software, middleware software, presentation management software,
etc.
Status Reporting—The status of configuration items/units is recorded
according to a documented procedure. This should enable the re-creation
of an application from various revisions.
Version Control—The check-in/check-out or revision management of
configuration items/units (e.g. process related documentation, software
requests, code, operating system software, etc.)
10.6 Change Management ■ 249
F-10 When the vendor updates the source code, the source code changes may
no longer be possible.
F-11 Whenever the vendor upgrades the source code, rework will be required
to make the changes to the source code again.
Introduction
Organizations, service providers, or departments that operate computer or tele-
communications equipment are responsible for ensuring that the appropriate
system management processes are implemented in accordance with company
policies and procedures. System management processes include, but are not
limited to, restart/recovery, problem management, change management, secu-
rity, and performance management.
Introduction
The objective of disaster recovery and contingency planning for computer sys-
tems and telecommunications is to ensure the continuance of the company’s
10.8 Disaster Recovery and Business Contingency Planning ■ 253
Definitions
Business Continuity Plan—The business continuity plan is used by
organizations of all sizes to detail how business will continue if a disaster or
emergency occurs. The business continuity plan documents all business
operational functions by department, employee, and supplier information,
inventory, emergency procedures, and post-disaster plan.
Additionally, applications should be prioritized that are critical to the
successful operation of the company and acceptable downtime should be
determined when establishing business continuity plans. The business
continuity planning process should encompass the steps needed if a dis-
ruption in business or a disaster occurs. The plan should consider the
business process and IT impacts as well as the applications that are main-
tained in the cloud.
The following table is an example of a business continuity plan.
1. Document internal key personnel with backups. These are key employees that are
integral to the function of your business processes. A controller should identify the
key employees by each business process. It’s important to identify backups.
■■ Consider which job functions are critically necessary every day. Think about who
fills those positions when the primary job-holder is on vacation.
■■ Make a list of all those individuals with all contact information, including business
phone, home phone, cell phone, pager, business e-mail, personal e-mail, and
any other possible way of contacting them in an emergency situation where
normal communications might be unavailable.
254 ■ Computer, Telecommunications, and Systems Controls
2. Identify who can telecommute. Some people in your company might be perfectly
capable of conducting business from a home office.
3. Document external contacts. If you have critical suppliers, contractors, or con-
sultants, build a special contact list that includes a description of the company (or
individual) and any other absolutely critical information about them, including key
personnel contact information. Include in your list people like attorneys, bankers, IT
consultants, and solution providers. This list should include anyone that you might
need to call to assist with various operational issues.
4. Document critical equipment and access to ERP Systems. Determine if a copy
machine and fax are necessary if ERP access is not possible.
5. Identify critical files and documents. These include articles of incorporation, finan-
cial key supplier contracts, utility bills, banking information, critical HR documents,
building lease papers, and tax returns. Key Point: Remember the requirements for
HIPAA and GDPR.
6. Identify your contingency location if needed. This is the place you will conduct
business while your primary offices are unavailable. Depending on the situation it
could be a hotel or telecommuting may be a viable option.
7. Make a “How-to.” It should include step-by-step instructions on what to do, who
should do it, and how. Your organizations policies and procedures are critical. Public
companies can use Sarbanes-Oxley documentation. Ensure that business processes
are assigned to a “lead” person as suggested in step 1. Key processes should be
prioritized.
8. Put the information together. A business continuity plan is useless if all the compo-
nents are scattered all over the company. Each key process business should have an
electronic folder (and backup) with all the key information. If necessary, the contents
of the folder can be printed.
9. Communicate. Make sure everyone in your company is familiar with the business con-
tinuity plan. Hold mandatory training classes for each and every employee. Schedule
refreshers periodically.
10. Test the plan. All business continuity plans should be tested to make sure all the key
components have been identified and the plan can be executed. Schedule refreshers
of tests of the plan periodically.
11. Plan to update the plan. No matter how good your plan is, and no matter how
smoothly your test runs, it is likely there will be events outside your plan.
12. Review and revise. Every time something changes, update all copies of your
business continuity plan and initiate the business continuity plan communication pro-
cess again. With all the changes in technology, it’s important to ensure that the plan
is never outdated.
13. Consider next steps. Consider the next steps for recovery and identify what needs
to happen to bring the organization, region, country, or division back online.
10.8 Disaster Recovery and Business Contingency Planning ■ 255
Introduction
This section recommends the controls for the manual input process into pro-
duction systems or systems of record.
Introduction
This section recommends the controls for the output process from production
systems or systems of record.
10.10.3 Report Headings. All online video screens or reports should include
sufficient information to ascertain their origin, period covered, appro-
priate titles, completeness, and their information classification.
Refer to risks: J-l, J-2, J-3, J-4
10.10.4 Distribution of Company Restricted and Company Confiden-
tial Information. Owners/service providers and application system
users must establish and implement procedures to ensure that recip-
ients of Company Restricted and Company Confidential reports are
appropriately advised of their personal responsibility to promptly col-
lect and secure these materials.
Refer to risk: J-4
10.10.5 Records Management. Data files, data storage media, and com-
puter reports containing Company Restricted and Company Confi-
dential information must be controlled and properly destroyed after
their useful lives.
Refer to risk: J-4
Introduction
Paperless transaction processing refers to a business operation in which elec-
tronically processed or stored information replaces the traditional paper trail
of evidence. Paperless processing control provisions, like those for a manual
processing environment, are concerned with the authorization, accuracy, com-
pleteness, and timeliness of transactions. Thus, all relevant business process
and application controls apply to all parts of the electronic exchange, including
262 ■ Computer, Telecommunications, and Systems Controls
Definitions
EDI—Electronic Data Interchange (EDI) is the transfer of structured data,
by agreed message standards, from one computer system to another, using
an electronic means.
Electronic Commerce—Doing business electronically.
Paperless Transactions—Any transaction conducted via an electronic
means. This could include but is not limited to fax, phone, voice response,
e-mail, etc.
Trading Partner—Any organization with which a trading relation-
ship is established. A trading partner can be a third-party company or an
internal company organization.
Trading Partner Agreement (TPA)—An agreed code of conduct bet-
ween parties involved in electronic commerce. It applies only to the
electronic interchange of data and not to the substance of the message
transmitted. It deals with questions of security, verification, and authen-
tication of the communicating parties. The purpose of a TPA is to provide
a set of rules that set out minimum standards with which parties trading
electronically will comply.
Introduction
A legitimate business may exist for accessing non-company networks and
bulletin boards, which are defined as networks and bulletin boards, which are
not sponsored or controlled by company. While these networks can provide the
company with a great deal of valuable information, they also greatly increase
10.12 Non-Company Networks and Bulletin Boards ■ 265
Definitions
Computer Virus—Program that contains software instructions
necessary to make replicas of itself and insert these instructions in the
execution path of other programs without the knowledge or permission
of the user.
Firewalls and Intrusion Detection Systems (IDSs)—In many com-
panies, firewalls serve as the main defense against intruders and act as
a gateway for all inbound and outbound network connections. IDS soft-
ware, on the other hand, helps keep track of network activities. Because
of their importance, internal auditors working in small and mid-size com-
panies should recommend that IT departments implement the following
protocols to enhance their use of firewall and IDS tools:
L-5 Passwords to user computer accounts may be disclosed and allow unau-
thorized access to data and programs.
L-6 Unauthorized access attempts may be made on a regular basis without
detection.
L-7 Programs and/or command files containing destructive code such as
computer viruses, Trojan horses, logic bombs, etc. may be introduced
into company computing resources.
L-8 Implementation of the software may result in erroneous system
processing.
L-9 The source of the software may not be legitimate.
L-10 Copyright law or a standing licensing agreement, which the company
has with a vendor, may be violated.
L-11 Sensitive information may be accessed and/or disclosed to unauthorized
personnel.
L-12 Adequate computing resources may not be available to meet business
requirements.
L-13 Communications may not accurately depict the company, its business
activities, its products, or its services.
L-14 Communications may not be consistent and properly representative of
the company.
L-15 Company may be liable for misuse or unauthorized copying of proprie-
tary material.
L-16 The company may be liable for the misuse of computer resources.
Protection of Assets: Human,
Physical, and Intellectual
11 CHAPTER EL EVEN
INTRODUCTION
This section includes the functions necessary for all members of management
to effectively fulfill their responsibility to secure the company’s assets and
employees, maximize profitability, and enhance the maintenance of business
continuity. All policies, procedures, and practices implemented to fulfill these
standards must be based on compliance with local laws and practices that
may be specific to a particular site or business process. (e.g. Payroll, Treasury,
Accounts Payable, etc.)
PROCESS OVERVIEW
The diagram below suggests that the foundational elements that support the
protection of human, physical, and intellectual assets are Internal Controls and
Compliance, Security Framework, and Code of Conduct and “Tone at the Top.”
271
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
272 ■ Protection of Assets: Human, Physical, and Intellectual
Security Framework
Protect Intellectual Training and Self-
and Asset Incident Reporting
Property Assessment Process
Classification
Develop a Secuirty Program Identify and Track Security Establish a Process for Develop Security Training
and Controls Framework Incidents Confidentiality and Non- Program for Employees and
Disclosure Agreement Non-Employees
Identify Key Company and
High Value Assets Classify Company Documents Implement a
Report Security Risks
and Information Self-Assessment Process
Define Employee and Non-
Employee Access Processes
Administer Security Resolve Security Risks Protect Second Party Report and Take Action on
Guidelines and Company Information Self-Assessment Results
Security Requirements
METRICS
Table of Metrics
Security Metrics
■■ Number of Corporate Facilities
■■ Number of Security Policies, Standards, Procedures, and Metrics with Com-
mitted Owners
■■ Percentage Compliance with Security Policies, Standards, Procedures, and Metrics
■■ Company Employee Security Awareness Level
■■ Number and Severity of Findings in Audit Reports and Self-Assessments
■■ Number of Internal Controls Identified
■■ Percentage of Internal Controls Tested
■■ Number of Security Incidents Reported per Fiscal Period
■■ Time Lag Between Incident and Detection
■■ Number of Nuisance Alarms
■■ Security Cost as a Percentage of Total Company Revenue
■■ Number of Safety Hazards Proactively Identified and Eliminated annually
■■ Number of Failed Responses to Issues Identified by Security
Intellectual Property
■■ Number of Background Checks Conducted for New Hires
■■ Time Spent per Employee in the Innovation Process
■■ Cost to Support Innovation Initiatives
■■ Number of New Products, Services, or Inventions Generated Annually
■■ Revenue Generated from Sales of Products Using Patented Assets
■■ Revenue Opportunities Generated from Licensing New Products
■■ Revenue Loss from Violations of Non-Disclosure Agreements
SUB-PROCESSES
Introduction
Management must designate a specific employee (or employees) to be respon-
sible for the administration, maintenance, and implementation of the local
security program and implement a tracking and reporting process for reporting
and correcting issues.
11.1.3 Security Guidelines. These standards must be used to form the basis
of all security programs. All security guidelines and procedures must
be maintained and available to all affected employees. All policies and
procedures related to security must be submitted to corporate security
for approval. Issues arising from this approval process will be referred
to the director of corporate security for resolution.
Refer to risks: A-2, A-3, A-5, A-6, A-7
11.1.4 Incident Reporting. Management will develop procedures for docu-
menting and reporting incidents (e.g. fraud, theft, embezzlement, or
unlawful or unethical practices or conditions) that result in the actual
or potential loss of company assets. Additionally, serious operational
security incidents or high-profile losses must be reported promptly
to corporate security. The reporting process must be linked with the
company’s Security Incident Reporting System to provide updates to
corporate security and, through internal audit, provide updates to the
board of directors.
Refer to risks: A-2, A-5, A-6, A-7
11.1.5 Security and Related Forums. Security and related personnel will
participate with corporate security in formally established geographic
and/or divisional security forums to discuss security issues, risks, and
appropriate countermeasures.
Refer to risks: A-2, A-5, A-8
11.1.6 Identification of Key Assets. Management will develop and imple-
ment an annual process for identifying the key assets entrusted to
their organization. The process should include discussions with other
appropriate organizations (e.g. technical and business intelligence,
other organizations involved in the business process). The assets con-
sidered should include physical assets, information systems, intel-
lectual property, and proprietary information. An asset should be
considered as key if the loss of or inability to use the asset would signif-
icantly impact revenue or the ability to meet customers’ needs and/or
maintain a competitive position. The characterization of critical assets
should include:
a. Description
b. Function in the business (how asset is used)
c. Why the asset has value (e.g. essential for operations, competitive
advantage)
d. Description of the form(s)
e. Who uses the asset
276 ■ Protection of Assets: Human, Physical, and Intellectual
Introduction
In defining perimeter security, all company and subsidiary locations (including
any unimproved or apparently unused land), whether leased or owned, must
display appropriate notice(s) identifying the premises as company property
with access and activities restricted to company business.
11.2 Perimeter Security ■ 277
shall have controlled access to the site. Site procedures for controlling
non-employee access must address the following issues:
a. Days and hours when access is permitted
b. Business justification for being onsite
c. Use of non-disclosure and confidentiality agreements
d. Company host responsibility for non-employee’s access to the site
e. Authorized personnel who can grant non-employee access to a
specific site
Refer to risks: B-1, B-2, B-3, B-4, B-5, B-6, B-7
11.2.5 Property Control Procedures. The intent of this standard is to
describe specific standards related to controlling physical assets while
individuals are entering and leaving the premises. Management will
establish property control policies and procedures including:
a. Paper or electronic removal documentation with sufficient infor
mation (e.g. asset number, individual charged with responsibility,
time period asset will be off-premises) to account for the where-
abouts of corporate assets assigned to individual employees
b. Paper or electronic documentation that tracks non-company assets
(e.g. tools and equipment) that are brought on premises to ensure
accountability for the asset when it is removed from the premises
c. Inspection procedures appropriate for the site to assist in the safe-
guard of assets
d. An audit process to verify the effectiveness of controls
Refer to risk: B-2
Introduction
A person shall be in possession of only one company-issued corporate
identification badge. Persons who have not been issued permanent identification
shall be issued a visitor/temporary badge for entry to company sites and facil-
ities. Temporary identification badges may also be issued to employees and
non-employees who are not immediately in possession of their permanent
badge. Visitor/temporary identification badges shall have the holder’s name or
a number designation that is traceable to the holder. When entering a company
site facility, the company-issued identification may only be used by the person
whose name and image (if applicable) are printed on the badge. Identification
badges must be visible at all times while on company property.
Introduction
Management must ensure that corporate-level non-disclosure agreements
are in place and updated as appropriate for all vendors, partners, suppliers,
and select customers. Management must ensure that all employees and non-
employees working on company-owned or -leased facilities that have access to
company intellectual property complete an approved non-disclosure or confi-
dentiality agreement prior to having access.
Management must ensure the entire workforce is aware of the impor-
tance of protecting intellectual property and safeguarding company propri-
etary information, and can correctly identify the intellectual property used
in their work.
D-4 Laws and government regulations may be violated resulting in fines, pen-
alties, lawsuits, or contingent liabilities.
D-5 The company’s ability to conduct business may be significantly impaired.
D-6 The company’s ability to demonstrate ownership and control of its intel-
lectual assets is weakened.
D-7 Competitive advantage is weakened.
D-8 Reputation as a high-tech leader is weakened if the company cannot dem-
onstrate the security and integrity of data as required by regulatory com-
pliance requirements.
12
The Insurance Process
C HAPTER TWEL VE
INTRODUCTION
The insurance process includes the functions necessary for all members of
management to effectively fulfill their responsibility to safeguard the company’s
assets and employees, maximize profitability, and enhance the effectiveness of
the business continuity plan.
PROCESS OVERVIEW
The diagram below suggests that the foundational elements for the insurance
process are Internal Controls and Compliance, Company Insurance Coverage
and Business Continuity, and Code of Conduct and “Tone at the Top.”
METRICS
Table of Metrics
285
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
286 ■ The Insurance Process
Table of Metrics
SUB-PROCESSES
Introduction
The company’s facilities will be maintained in accordance with the relevant
protection standards based upon business criticality, all life/safety standards,
and regulatory guidelines. New company facilities will be designed to include
highly protected risks (HPR) specifications based on business criticality.
288 ■ The Insurance Process
Introduction
Insurance coverage against property and casualty risks will be designed to pro-
tect the company’s shareholders from significant financial loss and to meet all
legal and regulatory requirements. All insurance in the United States will be
purchased by the corporate risk management department, with the exception
of U.S. workers’ compensation insurance, and the cost will be allocated in com-
pliance with corporate policies and procedures.
Corporate risk management will be made aware of changes (e.g. acqui-
sitions, divestiture, new businesses, plant modifications, asset dispositions,
significant losses, etc.) occurring within the corporation and its units to
assure that insurance coverage adequately addresses risk exposures.
12.2 Insurance (Property and Casualty Risks) ■ 289
INTRODUCTION
PROCESS OVERVIEW
The diagram below suggests that the foundational elements that support EH&S
requirements are Internal Controls and Compliance, EH&S Compliance, and
Code of Conduct and “Tone at the Top.”
291
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
292 ■ Environmental, Health, and Safety (EH&S)
METRICS
Table of Metrics
SUB-PROCESSES
1
Wikipedia, “Environment, Health and Safety,” accessed January 3, 2019, https://en.wikipedia
.org/wiki/Environment,_health_and_safety.
294 ■ Environmental, Health, and Safety (EH&S)
Customer Services
INTRODUCTION
All customer services policies will comply fully with all other company policies.
The policy contact, working with the policy sponsor, ensures the achievement
of the intended results of the policy and that the policy is accurate and up to date.
Customer support center personnel should be highly knowledgeable and
able to satisfy customer requests quickly while providing quality service.
PROCESS OVERVIEW
The diagram below suggests that the foundational elements that support the
customer service process are Internal Controls and Compliance, Customer
Service Processes and Controls, and Code of Conduct and “Tone at the Top.”
METRICS
Table of Metrics
Customer Service
■■ Customer Satisfaction Rating (CAS)—This is a commonly used key performance
indicator to track how satisfied customers are with your organization’s products and/
or services.
297
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
298 ■ Customer Services
Table of Metrics
SUB-PROCESSES
14.1 Policy
14.2 Call Center Management
14.3 Warranty
14.4 Support Sales
300 ■ Customer Services
14.1 POLICY
Introduction
All customer services policies will comply fully with all other company policies
and standards. The policy contact, working with the policy sponsor, ensures
the achievement of the intended results of the policy and that the policy is accu-
rate and up to date.
Introduction
To ensure good customer service as required by company policy, call centers
will be established and managed to exceed service expectations, established
metrics, and internal controls.
for indicators that product may be flowing to the gray market from
ongoing special discount programs; and the reporting of any suspi-
cious activity as soon as it appears. Report any incident or suspected
incidents of gray market activity to your manager immediately, and
notify the Cross Border Program Office via e-mail or voicemail.
Refer to risk: B-2
14.2.4 Service Center Security. Alarm systems should be installed on all
doors and windows, including a duress alarm with shunting capabil-
ities. These systems should be tested on a regular basis to ensure they
are in proper working order. A corporate-approved security video sys-
tem should also be installed and checked on a regular basis to ensure
proper working order. Security tapes should be reviewed on a reg-
ular basis.
Refer to risk: B-3
14.2.5 Service Center Safety. Exits should be clearly marked with proper
signage, and emergency processes and phone numbers should be prop-
erly posted. Smoke and/or fire detectors should be located in service
center areas, and fire extinguishers should be properly tagged and in-
spected on a regular basis.
Refer to risks: B-3, B-4
14.2.6 Service Center Access. If key or access cards are used to gain entry,
access codes should be changed frequently and records should be main-
tained of which employees have keys.
Refer to risk: B-5
14.2.7 Handling of Cash. If cash transactions are processed at the ser-
vice center, the use of a safe is required. Access to the safe should be
restricted. Employees who handle cash should be bonded, and the cash
drawer should be reconciled at the end of each day to the point-of-sale
(POS) system reports. The cash should then be placed in the safe until
pickup by the armored car service.
Refer to risks: B-3, B-6
14.2.8 Training. All company service center employees should be properly
trained on the Code of Business Conduct, Retail Sales Procedures,
Point-of-Sales systems, Travel/Business Expenses, Inventory Control,
Emergency Procedures, Security, and Financial Procedures.
Refer to risk: B-7
304 ■ Customer Services
14.3 WARRANTY
Introduction
All company product warranties should be supported consistently throughout
the customer base without regard to the country of origin or the point of original
product purchase. Exceptions may exist within specific countries as dictated by
law and competitive practices.
include processing only those claims for which a broken part and
documentation is provided. Also, only those parts with a valid serial
number should be processed.
Refer to risk: C-3
14.3.4 Warranty Claims. Dealers should be credited only for warranty
claims that are submitted with the broken part.
Refer to risks: C-3, C-4
14.3.5 Customer Service Training. Company service personnel should
have a full understanding of the company’s warranty terms and the
overall returns process.
Refer to risks: C-3, C-5
14.3.6 Scrap Disposal Contracts. Written contracts should be in place
with all third-party vendors for the disposal of goods.
Refer to risks: C-6, C-7
14.3.7 Annualized Failure Rates. Annualized Failure Rates (AFR) for
products should be established and compared to the corporate goals,
after a product has been in production for a predetermined num-
ber of months, to determine if the product has performed above or
below the corporate goal. This will determine in a timely manner
whether corrective actions need to be taken with regard to engi-
neering, design, or component part replacement that could prevent
the contamination of an entire family or model.
Refer to risks: C-8, C-9
14.3.8 Warranty Claim Threshold. An average warranty claim thresh-
old for monitoring warranty claims should be established by
management. This threshold should assist in identifying potential
abuses by service dealers and determining when dealers should be
approached regarding their warranty claims.
Refer to risk: C-3
14.3.9 Serial Numbers. High-value components used in the company’s as-
sembly process, regardless of the manufacturer, including displays,
system boards, and memory-related components, should have serial
numbers. Serialization for parts over a certain dollar amount should be
etched or otherwise permanently affixed to the part to prevent tamper-
ing (no adhesive tags should be used). Procedures should include vali-
dation of the part serial number prior to warranty claim processing.
Refer to risks: C-3, C-5
306 ■ Customer Services
Introduction
Guidelines for customer sales and refunds should always be followed and prop-
erly posted to ensure visibility.
308 ■ Customer Services
INTRODUCTION
PROCESS OVERVIEW
The diagram below suggests that the foundational elements that support
the professional services processes are Internal Controls and Compliance,
Professional Service Controls, and Code of Conduct and “Tone at the Top.”
309
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
310 ■ Professional Services (PS)
Professional Services
Develop and Implement Policies Develop Project Plans for Order Certification
and Procedures Established Methodology
Capitalization of Software
Respond to Bids and Opportunities Report Expenses
Order Administration
Track Bids and Opportunities Track Costs and Budgets
Create the Customer Invoice
Establish Budget for Opportunities Report Project Status Ensure Customer Satisfaction
METRICS
Table of Metrics
There is a minimum set of controls that should exist in a normal business envi-
ronment. The internal control standards listed here represent the minimum con-
trols to be implemented within the PS process.
SUB-PROCESSES
Introduction
Policies and procedures will be developed to support the company’s PS business
with proper training, internal controls, and risk management processes.
Adequate procedures must be implemented to effectively monitor and docu-
ment fulfillment of training requirements.
Introduction
All PS business opportunities require project approval. Waiver requests to use
different reporting tools are subject to approval by PS worldwide operations.
Introduction
A written project plan is required for all projects and subprojects. Project
planning activities should begin after initial meetings with the customer and
continue throughout the life of the project. The project plan must be main-
tained to reflect current information and past performance. Planning activ-
ities must address the scope, effort, resources, responsibilities, budget schedule,
and, if applicable, selling strategy and due diligence processes. The results from
project planning must establish baselines upon which proposals are made, con-
tracts are settled, changes are controlled, and performance is measured.
Introduction
All orders specifying professional services require approval. Orders and de-
certifications of orders must be written and communicated to the order entry
organization in a standard and timely manner. All allowances granted must be
approved by PS management prior to commitment to the customer. All engage-
ments must be priced using a consistent pricing model which establishes the
standard price for the engagement. Each country must establish a standard
billing rate for fee-based services used in calculating the standard price.
1
Ryan P. Bouray, CPA, and Glenn E. Richards, CPA, “Accounting for External-Use Software
Development Costs in an Agile Environment,” Journal of Accountancy, March 12, 2018, accessed
January 3, 2019, https://www.journalofaccountancy.com/news/2018/mar/accounting- for-
external-use-software-development-costs-201818259.html.
15.4 Customer Order Management ■ 323
D-9 The company could be held responsible for negligence, errors, or omis-
sions, resulting in financial loss to our shareholders.
D-10 The company’s competitive position or reputation could be adversely
affected.
D-11 Inaccurate costs or revenue are recorded against customer projects and
negatively impact profitability.
D-12 Intentional errors or misappropriations of assets could go undetected.
D-13 Sales transactions may be incorrectly prepared, and/or billings and
other terms may be misstated.
D-14 Sales transactions may have occurred but may not have been billed and/
or recorded.
D-15 Misappropriation of assets or intentional errors could occur. Examples
include the following:
a. Products or services may be shipped or provided but not billed.
b. Shipments or services provided may be billed but not recorded in the
accounting records.
c. Products or services may be billed and recorded but not shipped
or provided.
16
Entity-Level Controls
CHAPTER S IX TEEN
INTRODUCTION
The tone at the top sets the integrity of a company, directs the behavior of
employees, and is the basis for an organization’s ethical environment. When
those at the top display greed and overlook or even support fraudulent activ-
ities, it is logical to expect the entire company to follow that lead.
For example, Enron’s environment was known to be based upon a
“trading mentality.” By contrast, a tone at the top that makes it top priority
to do the right thing for employees, customers, and other stakeholders cre-
ates a company-wide environment of openness and honesty that not only
builds a fine reputation for its integrity, but also often brings about positive
financial results.
PROCESS OVERVIEW
The diagram below suggests that the foundational elements that support the
requirements for entity-level controls are Internal Controls and Compliance,
Corporate Policies, Code of Conduct and “Tone at the Top,” and the COSO
Framework.
325
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
326 ■ Entity-Level Controls
Entity-level Controls
Company Board,
Disclosure Other Company Ethics Office, and Internal Controls Internal and
Audit Committee External Audit
Committee Board Committees Senior Management Team
Team
Establish the “Tone at the
Adhere to Established Top” for the Company Validate and Update
Adhere to Established Adhere to Established Internal Controls
Charter Review the Results of
Charter Charter Programs
Implement Code the Company’s Internal
of Conduct Control Program
COSO Framework
Application of Internal Controls ■ 327
METRICS
Table of Metrics
■■ Number and Type of Issues Reported in the Ethics “Hot Line”—Tracks issues iden-
tified by employees using the ethics “hot line.”
■■ Number of Noncompliance Issues Reported by Type and Organization—Tracks
noncompliance issues by type and company organization.
■■ Number of Internal Control Self-Assessments Completed—Indicates the number of
self-assessments completed within a defined fiscal period.
■■ Number of Entity-Level Control Surveys Completed—Indicates the number of sur-
veys completed within a defined fiscal period.
■■ Response Rate per Each Entity-Level Control Issue Identified—Determines the
response rate for each survey issued.
■■ Number of Issues Reported by the Entity-Level Control Survey—Determines the
number of issues reported by respondents of the entity-level control survey.
■■ Internal Control Issues by Type—Identifies the number of control issue by type.
■■ Number of Control Self-Assessments Completed per Period—Identifies the num-
ber of control self-assessments completed by defined physical period.
■■ Number of Internal Audits Executed—Number of audits conducted by the internal
audit team.
■■ Average Length of Service per Board Committee Member—Indicates the average
length of service for a board committee member.
■■ Number of Corporate Policy Violations by Type—Tracks the number of corpo-
rate policy violations by type (e.g. Delegation of Authority (DoA) or Segregation of
Duties (SoD).
controls focus on the governance and control environment of the entity. The
concept of entity-level controls is somewhat complicated since these con-
trols focus on the corporate level. They are referred to as “soft” controls and
can be tested using the standards of internal control defined in this section
or executing an entity-level controls level to a selection of employees.
SUB-PROCESSES
Introduction
What is corporate compliance? Simply put, corporate compliance is the pro-
cess of making sure your company and employees follow the laws, regulations,
standards, and ethical practices that apply to your organization.
Effective corporate compliance will cover both internal policies and rules
and federal and state laws. Enforcing compliance in corporate policy will help
your company prevent and detect violations of rules. This can save your organi-
zation from fines and lawsuits. Corporate compliance also lays out expectations
for employee behavior, helps your staff stay focused on your organization’s
broader goals, and helps operations run smoothly.1
Key Point: Compliance screening and regulatory requirements used to
be the concerns of financial institutions. Now all organizations and global
corporations are accountable for compliance screening programs, ongoing
internal controls, and applicable due diligence programs to ensure that sup-
pliers, customers, and even employees are not terrorists, enemies of the
United States, money launderers, or Medicare and Medicaid fraudsters.
The table below indicates which industry should be paying attention to
a specific regulatory requirement. The table also indicates which financial
processes are impacted.
1
Power DMS, “What Is Corporate Compliance and Why It’s Important,” accessed January 6. 2019,
https://www.powerdms.com/blog/what-corporate-compliance-is-why-compliance-is-important/.
16.1 Compliance and Compliance Screening ■ 329
16.1.3 The compliance program has a business plan that specifies objectives,
staffing, and budget requirements.
Refer to risks: A-1, A-2, A-3, A-4, A-5, A-6, A-7, A-8, A-9,
A-10, A-11
16.1.4 The compliance organization receives updates from each disclosure
and audit committee meeting.
Refer to risk: A-8
16.1.5 Possible compliance violations reported via the ethics line are com-
municated to the compliance and finance organizations.
Refer to risk: A-8
16.1.6 The compliance group periodically evaluates the risk of noncompli-
ance and criminal conduct.
Refer to risk: A-8
16.1.7 Establish clear responsibility for the compliance program and the
screening requirements for each specific business process.
Refer to risks: A-1, A-2, A-3, A-4, A-5, A-6, A-7, A-8, A-9,
A-10, A-11
16.1.8 Adequate resources are established for the compliance program.
Refer to risks: A-1, A-2, A-3, A-4, A-5, A-6, A-7, A-8, A-9,
A-10, A-11
16.1.9 Establish standards and procedures to prevent and detect violations
of law.
Refer to risks: A-9, A-10, A11
16.1.10 Communicate standards of conduct and procedures to prevent and
detect violations of law and regulatory compliance requirements.
Refer to risks: A-9, A-10, A11
16.1.11 Senior management and the board oversee a compliance program for
the company and ensure the effectiveness of the compliance program.
Refer to risks: A-1, A-2, A-3, A-4, A-5, A-6, A-7, A-8, A-9,
A-10, A-11
A-4 Lack of reporting may impact the company’s future business dealings
with government agencies.
A-5 Compliance screening does not take place and issues are not reported,
prioritized, and addressed.
A-6 Without a timely view of the legal risks that a company faces, the com-
pliance program may be addressing the wrong risks.
A-7 Without clear responsibility for the compliance program, business and
legal risks to the company are not identified, risks would not be evalu-
ated in a formal and consistent manner, policies may be promulgated
from a parochial perspective that does not consider the enterprise per-
spective, policies are inconsistent across the enterprise, employees do
not receive necessary training, and the effectiveness of the policy and
training is never processed.
A-8 A compliance program with inadequate resources is at the risk of being
ineffective. An ineffective compliance program is less likely to be able to
prevent and detect violations of law. An ineffective compliance program
subjects the company to greater risk of criminal, civil, or administrative
enforcement action.
A-9 Without standards of conduct and procedures, employees may not
be aware of the laws, policies, and regulations that govern their
activities.
A-10 Standards of conduct, screening requirements, and procedures that are
not communicated are less likely to be followed.
A-11 The absence of an effective compliance program could subject the
company to additional criminal, legal, financial, and reputational risk.
Introduction
As important as an internal control structure is to an organization, an effective
system is not a guarantee that the organization will be successful. An effective
internal control structure will keep the right people informed about the organi-
zation’s progress (or lack of progress) in achieving its objectives. As a standard,
the organization with overall responsibilities for the internal control and reme-
diation is critical to the success of the program
332 ■ Entity-Level Controls
16.2.11 The internal controls team provides SOX 404 training and communi-
cation sessions on a monthly to quarterly basis.
Refer to risk: B-9
16.2.12 There is a linkage between the internal controls team, internal, and
external audit to ensure control risks are addressed and remediation
activities are coordinated.
Refer to risks: B-8, B-11
16.2.13 The internal control team uses project management processes as pre-
scribed through the Project Management Institute (PMI).
Refer to risks: B-8, B-9, B-11, B-12
16.2.14 The internal controls team is apprised of changing risks and condi-
tions as defined by the compliance officer, and the internal–external
audit teams.
Refer to risks: B-1, B-2
Introduction
Entity-level controls are internal controls that help ensure that management
directives pertaining to the company are implemented, tested, remediated, and
appropriately updated. Management of a company must ensure that risk is
identified and mitigated with the proper controls and organizational structure.
Introduction
The audit committee’s role includes: the oversight of financial reporting; the
monitoring of accounting policies; the oversight of any external auditors;
regulatory compliance; and discussion of risk management policies with
336 ■ Entity-Level Controls
16.4.23 The audit committee reviews the roles of the disclosure committee.
Refer to risks: D-21, D-24
16.4.24 Meetings with the chief financial officer (CFO) and/or accounting
officers, internal auditors, and external auditors are held frequently
and timely.
Refer to risk: D-25
16.4.25 As a part of corporate governance requirements, compensation
committee issues are reviewed by the audit committee.
Refer to risk: D-27
16.4.26 The committee serves in an oversight role to the public reporting of
the company’s financial statements.
Refer to risks: D-14, D-26
16.4.27 Related-party transactions do not present a conflict of interest.
Refer to risk: D-27
16.4.28 Audit committee roles and responsibilities are clearly defined and
articulated to the audit committee prior to voting.
Refer to risk: D-28
16.4.29 The audit committee reviews the audit committee charter before
voting that the charter is final.
Refer to risk: D-28
Access Controls These are the procedures and controls that limit or detect access to
critical network assets to guard against loss of integrity, confidentiality, account-
ability, or availability. Access controls provide reasonable assurance that critical
resources are protected against unauthorized modification, disclosure, loss, or
impairment.
Account Number Defines the accounting transaction type for the transaction and
includes a system-generated number tied to a company’s chart of accounts.
Accounts Payable Business processes supporting the functions of issuing payment
for property, goods, and services. Sub-processes include supplier, authorization
processes, invoicing processing and payment, freight analysis, and account recon-
cilement and process analysis.
Accounting Policy Basic concepts, assumptions, policies, methods, and practices
used by a company for maintaining accounting principles and summarization
into financial statements as prescribed by GAAP. A policy can be described as what
needs to happen to ensure that accounting cycles are working within boundaries
of internal control.
Accounting Procedure The routine steps in processing accounting data during an
accounting period. In sequence, (1) occurrence of the transaction, (2) classification
of each transaction in chronological order (journalizing), (3) recording the clas-
sified data in ledger accounts (posting), (4) preparation of financial statements
and (5) closing of nominal accounts. A procedure ensures that a policy is prop-
erly executed and explains how. Other procedures or policies will be referenced if
applicable.
Accruals Accruals are adjustments for (1) revenues that have been earned but are not
yet recorded in the accounts, and (2) expenses that have been incurred but are not yet
recorded in the accounts. The accruals need to be added via adjusting entries so that
the financial statements report these amounts.1
1
Accounting Coach, “What Are Accruals,” accessed January 1, 2019, https://www.accounting
coach.com/blog/what-are-accruals.
341
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
342 ■ Glossary
ACH Credit An ACH credit is like depositing money in an account. In an ACH credit
transaction, the individual/originator/business/agency instructs the financial
institution to credit an account with money. The payment is then made via the
ACH to the respective account. ACH credit payments are sometimes called “push
payments” because the payer initiates the transaction by “pushing” the funds to
the recipient’s account.
ACH Debit For example, a customer wants to pay an electric bill via ACH debit. The
customer is the originator of the transaction, and his bank is the Originating Finan-
cial Depository Institution (ODFI). The customer authorizes his bank, the ODFI, to
send money from his account to the recipient’s upon the recipient’s request. ACH
debit transactions are sometimes called “pull payments” because they are initiated
by the recipient “pulling” funds from the payer’s account.
ACH Payment ACH is an acronym for “Automated Clearing House.” The ACH net-
work is responsible for transferring money from bank to bank in a “paperless”
transaction.
Audit Committee The audit committee’s role includes: the oversight of financial
reporting; the monitoring of accounting policies; the oversight of any external
auditors; regulatory compliance; and discussion of risk management policies with
management. The audit committee may approve the company’s internal annual
internal audit plan and is usually apprised of any suspicions of fraud reported via
the ethics hotline process.
Best Practices Implementation of the highest quality, most advantageous, repeatable
processes achieved by applying the experiences of those with the acquired skill or
proficiency.
Business Continuity Planning Process of developing advance arrangements and
procedures that enable an organization to respond to an event in such a manner
that critical business functions continue with planned levels of interruption or
essential change.
Business Continuity Program An ongoing program supported and funded by
management to ensure business continuity requirements are assessed, resources
are allocated, and recovery strategies and procedures are completed and tested.
Cardholder Agreement A cardholder agreement is a document given to credit card
holders that details the rights and responsibilities of both the cardholder and
the issuer.
Change in Accounting Principle When a company adopts an alternative gener-
ally accepted accounting principle to a previously used principle to account for
the same type of transaction or event, that action is called a change in accounting
principle. The term accounting principle includes not only accounting principles
and practices but also the methods of applying them. The initial adoption of an
accounting principle in recognition of events or transactions occurring for the first
time or that were previously immaterial in their effect is not considered a change
in accounting principle. A change in accounting principle differs from a change in
Glossary
■ 343
2
Accounting Tools, “Contra Revenue,” posted November 17, 2017, accessed January 1, 2019,
https://www.accountingtools.com/articles/what-is-contra-revenue.html.
344 ■ Glossary
Copy Any information that is duplicated and is used for reference purposes only.
Copies are normally kept for a short period of time and are never sent to offsite
storage. Each employee/contractor and business unit is responsible for disposing
of their copies within the time frame specified under the column “Copy Retention
Maximum” as specified on a records retention schedule.
Cost Center The designated accounting location, in which costs are incurred, defined
as a sub-unit of a legal entity and in some cases the business unit depending on
how the business unit code is utilized. All cost centers are assigned to a legal entity;
however, only some cost centers may be assigned to business units. It is distin-
guished by an area of responsibility, location, or accounting method.
Cost Management Financial processes that support cost accounting, inventory
accounting, and cost analysis.
Critical Application A critical business application is one that company must have
to support major revenue activities, movement of goods to customers, a stra-
tegic manufacturing process, or to fulfill contractual or regulatory obligations. In
addition, the application’s availability is deemed by management to be vital to the
continued functioning of company business. Examples of critical applications are:
customer service support, order entry, inventory control, manufacturing resource
planning, purchasing, warehouse control, quality assurance, and finance.
Critical Processes Business processes that if disrupted or made unavailable for any
length of time will have a significant negative impact on the success of the business.
Data Model Establishes data definitions and processes for reference, ensures data
rules are utilized, and provides a schematic view of the underlying components
comprising the data that drives the financial function.
Disaster A loss of computing or telecommunication resources to the extent that rou-
tine recovery measures cannot restore normal service levels within 24 hours,
which impacts the company’s business significantly.
EDI Electronic Data Interchange (EDI) is the transfer of structured data by agreed mes-
sage standards from one computer system to another using an electronic means.
Electronic Commerce Doing business electronically.
Entity Level Controls Entity-level controls have a pervasive influence throughout
all organizations. If they are weak, inadequate, or nonexistent, they can impact
material weaknesses relating to an audit of internal control. Week entity-level
controls can also lead to material misstatements in the financial statements of
the company. The presence of material misstatements could result in receiving
an adverse opinion on internal controls and a qualified opinion on the financial
statements.
Enterprise Resource Planning (ERP) System An ERP is an integrated business
process management software that allows an organization to use a system of
integrated applications to manage the business and automate many back-office
functions related to technology, services, and human resources.
Glossary
■ 345
Formerly known as the National Bureau of Standards, NIST promotes and main-
tains measurement standards. It also has active programs for encouraging and
assisting industry and science to develop and use these standards.3
Net Income Net income is equal to net earnings (profit) calculated as sales less cost
of goods sold, selling, general and administrative expenses, operating expenses,
depreciation, interest, taxes, and other expenses.
Non-Records Any tangible information that does not typically contain data pertain-
ing to or originated by the company. Materials are typically used as reference or
research tools by the staff and include such items as newspapers, periodicals, bro-
chures, public and Internet information, and toolkits.
Office of Record Any business unit that is assigned responsibility for maintaining
“official” company records.
Official Records These records are those which are required to be kept to meet
statutory, regulatory, or contractual requirements, and those kept pursuant to
good business practice for periods of time as specified in the corporate records
retention schedule.
Organizational Controls Should cover all aspects of a company’s activity without
overlap, and be clearly assigned and communicated.
■■ Responsibility should be delegated down the level at which the necessary exper-
tise and time exists.
■■ No single employee should have exclusive knowledge, authority, or control
over any significant transaction or group of transactions.
■■ Agreeing realistic qualitative and quantitative targets strengthens
responsibility.
■■ The structure of accountability depends upon continuing levels of compe-
tence of employees in different positions and the development of competence
so that responsibility and reporting relationships can be regrouped in more effi-
cient ways.
Paperless Transactions Any transaction conducted via an electronic means such as
an electronic purchase order, invoice, or payment.
Payment Type A payment is the trade of value from one party (such as a person or
company) to another for goods, or services, or to fulfill a legal obligation. The most
commonly used payment methods include cash, check, or debit card, credit card,
wire, or ACH payments. Payments may also take complicated forms, such as stock
issues or the transfer of anything of value or benefit to the parties. In U.S. law, the
payer is the party making a payment while the payee is the party receiving
the payment. In trade, payments are frequently preceded by an invoice or bill.
3
National Institute of Standards and Technology (NIST), “Definition: NIST (National Insti-
tute of Standards and Technology), accessed January 13, 2019, https://searchsoftwarequality
.techtarget.com/definition/NIST.
Glossary
■ 347
On May 28, 2014, the FASB and the International Accounting Standards Board (IASB)
issued (press release) converged guidance on recognizing revenue in contracts
with customers. The new guidance is a major achievement in the Boards’ joint
efforts to improve this important area of financial reporting.
Presently, GAAP has complex, detailed, and disparate revenue recognition require-
ments for specific transactions and industries, including, for example, software and
real estate. As a result, different industries use different accounting for economi-
cally similar transactions.
The objective of the new guidance is to establish principles to report useful information
to users of financial statements about the nature, amount, timing, and uncer-
tainty of revenue from contracts with customers. The new guidance:
■■ Removes inconsistencies and weaknesses in existing revenue requirements
■■ Provides a more robust framework for addressing revenue issues
■■ Improves comparability of revenue recognition practices across entities, indus-
tries, jurisdictions, and capital markets
■■ Provides more useful information to users of financial statements through
improved disclosure requirements
■■ Simplifies the preparation of financial statements by reducing the number of
requirements to which an organization must refer4
Risk Assessment/Analysis Process of identifying the risks to an organization,
assessing the critical functions necessary for an organization to continue business
operations, defining the controls in place to reduce organization exposure, and
evaluating the costs for such controls. Risk analysis often involves an evaluation of
the probabilities of a particular event.
Risk Management Risk management is an increasingly important business driver
since company stakeholders have become much more concerned about risk. Risk
may be a driver of strategic decisions, it may be a cause of uncertainty in the orga-
nization, or it may simply be embedded in the activities of the organization
SSAE 18 SSAE 18 is a series of enhancements aimed to increase the usefulness and
quality of SOC reports, now superseding SSAE 16 and SAS 70. The changes
made to the standard this time around will require companies to take more con-
trol and ownership of their own internal controls around the identification and
classification of risk and appropriate management of third-party vendor relation-
ships. These changes, while not overly burdensome, will help close the loop on
key areas where industry professionals noted gaps in many service organizations’
reports. The key changes are:
1. Service organizations will need to implement a formal Third Party Vendor
Management Program.
4
Financial Accounting Standards Board (FASB), “Why Did the FASB Issue a New Standard on
Revenue Recognition,” accessed January 1, 2019, https://www.fasb.org/jsp/FASB/Page/ImageB
ridgePage&cid=1176169257359.
350 ■ Glossary
5
Statement on Standards for Attestation Engagements 16 (SSAE 16), “The SSAE 18 Audit Stan-
dard (Updates and Replaces SSAE-16),” accessed January 13, 2019, https://www.ssae-16.com/
soc-1-report/the-ssae-18-audit-standard/.
Glossary
■ 351
353
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
354 ■ Addendum—Additional Tools
Control Mechanisms
■■ Organizational Controls should cover all aspects of the company’s
activity without overlap, and be clearly assigned and communicated.
Addendum—Additional Tools ■ 355
Detailed Delegation
Detailed Delegation Statement
■■ Delegation Process: Authority cannot be delegated other than as spec-
ified in this document. Delegation requires approval of the delegator’s
Addendum—Additional Tools ■ 357
Board of Directors
> $50M
Chief Executive Officer
General
Counsel
HR Legal
$0 < $5M O&T Finance Strategy Staff
Business and IT Others
Units
Double Key: reviewed proposals to the CFO and CEO for approval
Double Key: reviewed proposals to Finance and BUL/O&T for approval
Restrictions/Exceptions/Powers Reserved
In addition to those items specified in the certificate of incorporation and by-
laws, the Board reserves all authority not specifically delegated under the DoA,
including the following:
Corporate Governance
■■ The establishment of policies governing the conduct of the company and its
subsidiaries in relation to compliance with applicable laws and other such
policies as the Board may deem to have significance
■■ Changes to the company’s code of ethics
■■ The form and content of any proposed changes to the company’s certifi-
cate of incorporation or by-laws, any proposed changes to this DoA, or
any other change in the form of management governance and oversight of
the company
Disclosure
■■ All public disclosures, including any filings on behalf of the company
with the Securities and Exchange Commission (SEC) and other regulatory
bodies
■■ Any other disclosures by the company to its shareholders and their repre-
sentatives, the general public, and the business community
Addendum—Additional Tools ■ 359
Financial Matters
■■ Declaration of dividends
■■ The issuance, repurchase, exchange, and redemption or conveyance of the
right to any company equity securities
■■ Formation of debt facilities or issuance of long-term debt
■■ Mergers, consolidations, combinations, reorganizations, acquisitions or
divestitures with a value of $50M or more, involving the company or any
one of its subsidiaries
■■ Purchase or sale of a business, interest in a business or product line that is
valued at $50M or more
■■ Purchase, sale, lease, or sale/leaseback of real estate or other property
valued at $50M or more
■■ Recapitalizations, restructurings, spinoffs, splitoffs, Joint Ventures (JVs),
strategic alliances and other transactions having a material effect on the
capital structure of the company or its relationship to any subsidiary, group
of subsidiaries or any third party
■■ Formation, sale, merger, or liquidation of a significant subsidiary
■■ Purchase or sale of equity securities or interests in another company of
$50M or more
■■ Loans to other than affiliated companies of $5M or more
■■ Guarantees of indebtedness to other than affiliated companies of
$5M or more
■■ Consolidated annual charitable contributions budget
■■ Business-as-usual commitments over $50M
Compensation
■■ Maximum compensation level, salary changes, and salary ranges for all
officers and employees of the company
■■ Retention programs for acquisitions, dispositions, facility closings, or
other events
360 ■ Addendum—Additional Tools
■■ Severance programs
■■ Duration of employment contracts
■■ Equity grants
■■ Selection and retention of compensation consultants
Officers
■■ Appointment, election, termination, and other actions related to company
officers
Waivers
■■ Personal use of corporate assets
■■ Exemptions or exclusions from the company’s Code of Ethics and Business
Conduct
Other Matters
The Board also reserved the authority to review any other matter that it chooses.
Additionally, the Board must be informed of the following:
■■ The settlement of suits and claims against the company to the extent that
any required payments, agreements, consents, or commitments that may
be deemed to significantly affect the corporate enterprise
■■ The establishment of company objectives and revisions to earnings, bud-
gets, business plans, and capital expenditure plans
■■ Execution of contracts involving extraordinary obligations, risks or expo-
sures, other than renewals with substantially unchanged terms and
conditions
■■ Other matters judged by management to have significant and/or material
impact to the company, its activities, employees, or customers
Definitions
Commitment by the company includes the execution of any written agreement
or any other undertaking that obligates or binds the company in any respect
(e.g. oral statements, electronic mail, or other representations), whether or not
it involves the payment of money. Employees must never execute a document
or otherwise commit the company unless they have clear authority to do so.
Company means the company and its worldwide operating subsidiaries.
Delegation of Authority is the formal written conveyance from one
person to another of the authority to bind the company to a legally enforce-
able obligation. The authority to execute documents, make binding commit-
ments, and authorize actions on behalf of the company is delegated to the
appropriate corporate officer or those named in a specific delegation.
Delegation of Primary Authority applies to officers and employees
who delegate their authority. These individuals remain responsible for mon-
itoring and reviewing the actions of those to whom authority has been
granted.
“Double-Key” process is management’s approach to ensure that the
right level and scope of approval has occurred for a transaction. Its def-
inition is a principle: “For all materially important decisions, the manager
responsible for the execution of the decision must obtain the concurrence of
another manager at a comparable level of responsibility.” Its usage derives
from the two keys needed to unlock a safe deposit box in a bank vault.
The Board refers to the Board of Directors.
Addendum—Additional Tools ■ 363
BUL DR-BUL
(8) Cor-
Summary Delegation Of Authority MCI O&T and DR-O&T General porate
Matrix Board CEO IT and IT Counsel CFO Controller Finance
SPENDING (7) Expenditures, Commitments,
Leases, General Purchases, Disposals
≥ 50MM A (6) P
≥ 5MM A (2) P A (2) R(5) R
≥ 1MM A (3) P R(5) A (3)
< 1MM A (4) R(5) A(4)
ACQUISITIONS / MERGERS / DIVESTITURES
/ JOINT VENTURE/
≥ 50MM A (6) P
< 50MM A (2) P A A (2) R R
LEGAL SETTLEMENTS
≥ 50MM I A (2) A A (2) R R
≥ 5MM A (2) P A A (2) R R
< 5MM A (3) P A R A (3)
CONSULTING/CONTRACTOR AGREEMENTS
≥ 1MM A(1) (6) A (2) P R A (2) R (1) R
≥ 500K A(1) (6) A (3) P R R (1) A (3)
< 500K A(1) (6) A (4) R R (1) A (4)
NOTE:
All approvals are subject to operating unit budget authorizations. R is Review, A is Approve, I is Inform, and P is Propose. DR is Direct
Report. BUL is the Business Unit Leader. O&TL is the Operations and Technology Leader. (1) Non-Audit Accounting, Tax or Consulting
Services offered by the external auditor. (2) The CEO and CFO will co-approve. (3) The BUL/O&TL and Corporate Finance will co-approve.
(4) The DR-BUL/O&TL and Corporate Finance will co-approve. (5) Review for capital expenditures. (6) Approval on non-Business as Usual
Transactions. (7) Augments require at least one-level higher approval than initial project (excluding CEO). (8) Procurement and Tax review
considered as overall Corp Finance review and approval.
364 ■ Addendum—Additional Tools
This policy reflects the major business decisions that establish the objectives
and provide direction for the company. Policies establish the basic process,
fundamental philosophies, and major values upon which the organization must
operate.
Policies differ from procedures in that procedures prescribe the means of
accomplishing the policy. Procedures provide personnel with the guidelines and
specific activities to ensure commonality, compliance, and control of policy related
activities.
The overall approach is one of global consistency from budget preparation through
consolidated reporting, with differentiated handling of processes for statutory or
division specific requirements only.
The policy is divided into six sections:
1. Introduction
2. Organizational Policy
3. Professional Standards
4. Risks and Internal Control Objectives Addressed by Policy
5. Functional Procedures
6. Addenda
Addendum—Additional Tools ■ 365
6.0 Addenda
6.1 Overview of Segregation of Duties Matrices
a. The matrix in 6.2 provides general guidance regarding segregation
of duties.
b. The matrices in 6.3 through 6.9 provide guidance for specific business
processes. When appropriate, these matrices can be used in lieu of the
general matrix in 6.2.
c. The matrices reflect the desired state of the segregation of duties, and
they represent the basis upon which functional business areas should
assess their current state.
d. Each row and column in a matrix represents a major business sub-process.
e. Where the intersection of a row and column is denoted by an “X,” the
corresponding business sub-processes represent incompatible functions
that should be segregated.
f. The segregation of duties can exist and should be assessed at the organi-
zational, functional, and/or systematic levels.
370 ■ Addendum—Additional Tools
AUTHORIZING TRANSACTIONS
RECORDING TRANSACTIONS
RECONCILING ACCOUNTS
PERFORMANCE RESULTS
PROVIDING IT SUPPORT
DEVELOPING BUSINESS
CUSTODY OF PHYSICAL
RESOLVING ISSUES OR
CASE JUSTIFICATIONS
AND TRANSACTIONS
DESCREPANCIES
TRANSACTIONS
TRANSACTIONS
REPORTING ON
ASSETS
GOALS
CUSTOMER CONTRACTS
CUSTOMER INCENTIVES
CREDIT MANAGEMENT
COLLECTIONS
A/R ENTRY
PRICING
BILLING
SIC
PROCESS GROUP NAME GROUP 01 02 03 04 05 06 07 08 09 10 11 12
CODE
CUSTOMER MASTER DATA 01 X X X X X X X X X X X
ORDER ENTRY 06 X X X X X X X
3.9.4 A/R PAYMENTS 07 X X X X X X X X X
3.7.1 A/R ENTRY 08 X X X X X X X X X
3.6.10 BILLING 09 X X X X X X X X X
APPROVE BILLING 10 X X X X X X X X X
COLLECTIONS 11 X X X X X X X X
3.7.1 POST A/R PAYMENTS 12 X X X X X X X X X X X
PAYMENT
A/P PAYMENTS
ADJUSTMENTS
PROCESS AND
MANAGEMENT
REQUISITIONS
REQUISITIONS
MASTER DATA
AGREEMENT
PURCHASE
PURCHASE
PURCHASE
PURCHASE
PAYMENTS
PAYMENTS
A/P ENTRY
INVOICES
RELEASE
RELEASE
RELEASE
POST A/P
ORDERS
ORDERS
VENDOR
VENDOR
VENDOR
PRICING
CHECK
CHECK
PRINT
APPROVE INVENTORY
GOODS RECEIPTS
DIFFERENCES
MOVEMENTS
MASTER
COUNT
SIC
PROCESS GROUP NAME GROUP 01 02 03 04 05 06 07 08 09
CODE
6.4.2 GOODS DELIVERIES 01 X X X X X X X
GOODS MOVEMENTS 04 X X X
PROJECT ACCOUNTING
ASSET MAINTENANCE
ASSET MASTER DATA
MANAGEMENT
GROUP
PROJECT ACCOUNTING
5.1.12 05 X X X X
MANAGEMENT
374 ■ Addendum—Additional Tools
FI MASTER DATA
BANK / CHECK
ACCOUNTING
PROCESS SIC CODE GROUP NAME GROUP 01 02 03 04 05
BANK / CHECK 01 X X X X
RECONCILIATIONS
G/L ACCOUNTING
FI MASTER DATA 02 X X X X
AUTHORIZE ELECTRONIC
DETERMINE SALARY /
RESOLVE EMPLOYEE
PAYROLL INQUIRIES
DISBURSE PAYROLL
PREPARE PAYROLL
INITIATE PAYROLL
DISBURSEMENTS
WAGE RATES
CHANGES
RESOLVE EMPLOYEE 04 X X X
PAYROLL INQUIRIES
7.2.7 DISBURSE PAYROLL 05 X X X X X
Addendum—Additional Tools ■ 375
Authorization Reconciliation
Responsibilities
System access will be defined based on individual employee roles and respon-
sibilities within financial and operational processes. Business owners have the
core responsibility for defining system access roles. Business owners will have
responsibility for reviewing and approving all user access requests.
Risk Assessment: If system access controls are not implemented, con-
trol weaknesses can occur.
■■ Purchases can be authorized and goods can be received from the transac-
tion at the user level.
■■ Inventory management and physical counts can be performed by the
same user.
■■ Sales can be invoiced and cash applied by the same user.
376 ■ Addendum—Additional Tools
■■ A sales order and the terms of sale can be approved by the same user.
■■ The same user can modify an evaluated receipts contract and receive
against a purchase order.
■■ Products can be shipped and sales order tolerances modified.
■■ A vendor can be established in the accounts payable process and payments
can be executed.
■■ An accounts payable user can create an erroneous accounts receivable
transaction.
■■ A general ledger user can post and pay accounts payable invoices.
User Initiates
Request
User’s Manager
Approves
Control Point
1) Reviews for Security
Object Privileges for Systems Business
intra-conflicts within Owner Reviews and
business process Approves Privileges
Request Is
Control Point
2) Reviews for Multiple Network Systems
Security Profile Security (NSS) or
Conflicts Appropriate IT Security
Organization Establishes
Privileges per Request
Control Point
Control Mechanisms
1. Control of Security Object Privileges
If security object privileges are not properly defined, intra-conflicts can occur
in which the user can have excessive or conflicting user access. A segregation-
of-duties issue arises when profiles, roles, or classes are not well defined at the
user level. The conflicting privileges introduce risk assigned to a user through a
single security object.
Control Mechanisms – Levels of Authority for Standard Customer Contracts and Sales Offerings
E S
. YC ION T E
R G
R C N
A AT E
N IC
E LI
N V
A
D .M FI
O E
R P
M
E
R
R .P R S
LE S E OP G LO LE
IT R R/ U
B AT IN VE L E
R
N TO E P OR UE ET E RO OM
.U C AG & P E
N K . D T T S
U
S P E N
IR A W R V A
R S N
U
S LE
B S
V
V
P D M LA CO RE M B
U
C
O
C S
A
The purpose of this tool is to define a standard and consistent testing strategy
and to establish a baseline of awareness related to the roles and responsibil-
ities for testing internal controls throughout the payment process. This tool
also provides a framework for the design of a test plan for individual business
processes. Corporates should have a well-defined sample selection methodology
documented and followed for each test of controls.
As general guidelines, internal control testing sample size should vary
with the following aspects of the business controls:
1. Management should be testing more than the minimum sample size requirements
included in the methodology.
2. Sample sizes should be directionally and respectively consistent with the minimum
requirements.
3. Sample sizes for testing of manual controls are based on frequency of the control and
historical sizes remain the minimum.
4. Medium and higher risk areas should have larger sample sizes.
5. Minimum requirements for sample size are based on the frequency of each control.
Management test samples must be representative and larger than these minimum
size requirements.
6. Professional judgment should be used in determining the need to increase the
sample size above the minimum. Several testing considerations for increasing the
sample size include:
■■ Increased complexity of the internal control is a factor.
■■ According to Auditing Standard Number 5,1 external auditors are permitted to place a
certain amount of reliance on the testing performed by management, depending on:
a. The nature of the test
b. The degree to which the tests are routine/standard
c. The competence and objectivity of the team performing the test
1
Public Accounting Oversight Board (PCAOB), accessed December 18, 2018, https://pcaobus.org/
Standards/Auditing/pages/auditing_standard_5.aspx.
Addendum—Additional Tools ■ 381
Number of Items
Frequency of Control (Minimum Sample Size)
Annual 1
Quarterly 2
Monthly 3 to 6
Indicators for Reduced Auditor Sample Indicators for Full Independent Audit
Size and Relying on Management Testing
Testing Techniques
There are four different testing techniques that can be used to test internal con-
trols. These testing techniques are summarized below:
As part of the testing process, various exceptions may be identified that will
be classified as a deficiency or weakness. Here is the process that controllers or
owners of internal controls should use to properly address the deficiency.
1. Identify deficiency.
2. Understand and assess management’s evaluation.
3. Identify compensating controls.
4. Assess likelihood of misstatement.
5. Assess potential magnitude of misstatement.
6. Determine classification of deficiencies.
7. Assess aggregation with other deficiencies.
Quarterly 2 quarters 1
Monthly 2 months 2
Weekly 4 weeks 2
Daily 30 days 10
Multiple times a day 30 days 30
Index
385
Internal Controls Toolkit, First Edition. Christine H. Doxey.
© 2019 John Wiley & Sons, Inc. Published 2019 by John Wiley & Sons, Inc.
386 ■ Index
B C
Backbone, 242 Call center management, 302–304
Balance adjustments, 73–74 internal control
Balance of Payments Programs, 196 standard, 302–303
Bank risk, 304
account, limits, 121 Canadian Institute of Chartered
payment, verification, 130 Accountants (CICA), 24
Banking requirements, Treasury Capital transactions, 91
controls, 89 Cardholder agreement, 130
Bearer checks, 120 Cash
Best possible DSO (metric), 52 forecasts, accuracy, 87
Billing petty cash, 122
inputs, 73 pooling, 90
transactions, 69 Cash rebates/deductions, 64
Bills of Material (BOM), 165 advance, 69
Blank check storage, 121 Cash receipts/application, 77–79
Blanket purchase orders, 109 duties, segregation, 77
Blank paper stock, usage, 71 internal control standard, 77–78
Blank payroll checks, security, 142 risk, 78–79
Blank shipping forms, 66 Cash-to-cash cycle time, 155
Bulletin boards, 264–269 CCL. See Commerce Control List
internal control Change management, 248–251
standard, 266–268 internal control
risk, 268–269 standard, 249–250
Business continuity risk, 250–251
internal control standard/risk, 290 Check 21
Business continuity plan(ning), Checks
252–259, 342 blank payroll checks, security, 142
internal control check-signing equipment, custody/
standard, 257–258 security, 122, 143
risk, 258–259 voided check procedures, 142
Business interruption contingency Classification category, examples
plans, 107 (information type), 216t
Index ■ 387
N O
National Association of Purchasing Objective setting (ERM
Card Professionals component), 29–30
(NAPCP), 127 Office for Civil Rights
National Institutes of Standards and (OCR), enforcement
Technology (NIST), 137 responsibility, 211
Net revenues, 83 Office of Foreign Asset Control
Network operations, 242–245 (OFAC), 98, 106
398 ■ Index
Payments Physical/electronic
time release, percentage, 87 records, protection
Payroll requirements, 217t–218t
bank accounts, 142 Physical inventory procedures, 162
checks, security/issuances/ Physical safeguards, 33
distribution, 142–144 Physical security, 229–232, 274
distribution, 144 control objective component, 33
earnings records, internal control
reconciliation, 139 standard, 230–231
expense distribution, 140 risk, 232
H2R process step, 133 Planning/control, 157–159
master file, 138 internal control
procedures, documentation, 139 standard, 157–158
records, 138, 143 risk, 158–159
source data, controls, 139 Point-of-sale (POS) system
withholdings, 139 reports, 303
Payroll payment controls, 141–143 Policy controls, 35
internal control Politically exposed persons
standard, 142–143 (PEPs), 106
segregation of duties, 143 Portfolio credit rating, 87
Payroll preparation/ Positive pay controls, 121
security, 138–141 PO to invoice conversion, 99
internal control Preventive internal controls, 33
standard, 138–140 Price establishment, 79–81
risk, 140–141 internal control standards, 79–80
segregation of duties, 140 risk, 81
P-cards. See Procurement cards Price protection, 69
Perfect order measurement, 155 Probable Maximum Loss (PML), 288
Perimeter security, 276–279 Procedure controls, 35
internal control Process
standard, 277–278 counting procedures, 162
risk, 278–279 metrics, 222
Personal identification, 242 Procurement cards
Petty cash, 122 (P-cards), 127–131
Physical assets, 271 audit log, statements
Physical damage, tracking, 129
protection, 287–288 internal control
internal control standard, 288 standard, 128–130
risk, 288 usage, 101
400 ■ Index
R Responsibility (strengthening),
Received goods, safeguarding, 115 qualitative/quantitative
Receiving, 113–116 targets (impact), 34
duties, segregation, 114 Retire (H2R process step), 133
internal control Revenue
standard, 114–115 reversal, 68
policy, 114 types, 69
records, changes, 115 Revenue recognition/billing, 67–72
risk, 115–116 duties, segregation, 69
Recorded sales transactions, 68 internal control standard, 68–72
Records management, risk, 71–72
113, 121, 207 Review controls, 35
classification standards, 208 Review error (metric), 175
internal control, Risk, 55, 61–62
application, 209–210 appetite, 29
metrics, 209 financial risk management, 90
process, 207 mitigation, usage, 97–102
sub-process, 211 property/casualty risks, 288–290
Record to Report (R2R), 173 response (ERM component), 30
internal controls, application, 177 risk-based internal controls, 12–14
metrics, 175–176 Risk assessment
process, 175, 182 ERM component, 30
impact, IFRS/GAAP internal control system
differences, 176 component, 21
sub-processes, 177 Robinson-Patman Act, 80
Recruiting (H2R process step),
133 S
Redeploy (H2R process step), SAE 18, 222–223
133 Sales
Regional contracts, 107 contracts, 60–62
Release management, 248 cutoff, 66
Remediation activities, financing, impact, 54
development, 37 goal structure, 80
Remittance inputs, 73 non-standard sales transactions, 68
Remote access, 233–234 planning, 157
Report to the Nations (ACFE), 1 process kick-back (metric), 51
Requisitioning procedures, 110 recorded sales transactions, 68
Research. See Market research sales weighted DSO calculation, 52
Reserves, 68 terms, 63
402 ■ Index